# Logstash WARN: Could not index event to Elasticsearch .... Can't get text on a START\_OBJECT

**URL:** <https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910>\
**Category:** Logstash\
**Created:** [August 11, 2022, 10:17am UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910 "2022-08-11T10:17:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [August 11, 2022, 10:17am UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910/1 "2022-08-11T10:17:04Z")

</div>

Dears,

I have some problem with json. When I send json log to logstash there are many errors like this:

```auto
Could not index event to Elasticsearch .... Can't get text on a START_OBJECT at 1:670

```

My json log looks like:

```auto
{"timestamp":"2022-08-11T10:25:47.866+0200","level":"INFO","logger":"q2","message":"Authorization message sent","sourceApp":"APPDH","data":[{"source":"csshi/192.168.13.12:10003","type":"send","payload":{"0":"1200","11":"403443","12":"220811102531","14":"2412","2":"459099 ______4152","22":"511501511328","23":"000","24":"200","26":"7011","3":"000000","32":"013203","35":"459099______ 4152= ____________________","37":"222308403443","4":"000000002400","41":"00005009","42":"100189000001","43":"Lab \\street. Kochanowskiego 11\\Warsow\\11-164 POL","49":"985","52":"qlWqVQ==","55":"qlWqVQ==","7":"0811082531","94":"db1136d7-f121-48a1-bf06-1f6308acbf40"},"objectType":"isoRequest","processingId":"db1136d7-f121-48a1-bf06-1f6308acbf40"}]}

```

Filebeat configuration looks like:

```auto
- type: log
  enabled: true
  paths:
    - /app/log/q2.log
  tags: ["app","app-dev","dhjson"]
  json.keys_under_root: true
  json.add_error_key: true

```

Logstash configuration looks like:

```auto
...
  if "dhjson" in [tags] {
    date {
      match => ["timestamp", "YYYY-MM-dd'T'HH:mm:ss.SSS", "YYYY-MM-dd'T'HH:mm:ss.SSSZ"]
      timezone => "Europe/Warsaw"
      target => "@timestamp"
    }
  }
...
  else if "dhjson" in [tags] {
    mutate {
      replace => { "[@metadata][index_prefix]" => "appdev-%{+YYYY.MM.dd}" }
    }
  }

```

Any idea what can be wrong?  
Can be a number as field name?

Best Regards,  
Dane

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 11, 2022, 12:29pm UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910/2 "2022-08-11T12:29:03Z")

</div>

You need to share the entire log error, not just part of it.

This error normally happens when you try to index an field that it is an json object, but the mapping for this field does not allow it, because it was not mapped as an object or you are using dynamic mapping and already indexed a field with the same name that was not an object.

Check this [forum post](https://discuss.elastic.co/t/cant-get-text-on-a-start-object/244340) about that message.

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [August 11, 2022, 1:32pm UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910/3 "2022-08-11T13:32:46Z")

</div>

@leandrojmp you are right. Firstly the field was a string, now log was change to json and the field is an object. Thanks a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2022, 1:33pm UTC](https://discuss.elastic.co/t/logstash-warn-could-not-index-event-to-elasticsearch-cant-get-text-on-a-start-object/311910/4 "2022-09-08T13:33:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.