# Main ERROR ESJsonLayout contains an invalid element or a ttribute "esmessagefields"

**URL:** <https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752>\
**Category:** Elasticsearch\
**Created:** [January 28, 2020, 4:48am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752 "2020-01-28T04:48:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Post date:** [January 28, 2020, 4:48am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/1 "2020-01-28T04:48:44Z")

</div>

Hello,

I have ES cluster with version 7.4.2.  
and i have version 7.3.1 also. ES clustering is working fine. But when i am trying to start ES services for version 7.3.1 . I am getting an error:

> Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was depreca  
> ted in version 9.0 and will likely be removed in a future release.  
> 2020-01-28 04:43:13,346 main ERROR ESJsonLayout contains an invalid element or a  
> ttribute "esmessagefields"  
> 2020-01-28 04:43:13,374 main ERROR ESJsonLayout contains an invalid element or a  
> ttribute "esmessagefields"  
> 2020-01-28 04:43:13,382 main ERROR ESJsonLayout contains an invalid element or a  
> ttribute "esmessagefields"  
> [2020-01-28T04:43:14,426][WARN][o.e.b.ElasticsearchUncaughtExceptionHandler] [N  
> L0123EPCC019] uncaught exception in thread [main]  
> org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: c  
> annot downgrade a node from version [7.4.2] to version [7.3.1]  
> at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163  
> ) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:  
> 150) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwar  
> eCommand.java:86) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:1  
> 24) ~[elasticsearch-cli-7.3.1.jar:7.3.1]  
> at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-c  
> li-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115  
> ) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)  
> ~[elasticsearch-7.3.1.jar:7.3.1]  
> Caused by: java.lang.IllegalStateException: cannot downgrade a node from version  
> [7.4.2] to version [7.3.1]  
> at org.elasticsearch.env.NodeMetaData.upgradeToCurrentVersion(NodeMetaDa  
> ta.java:94) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.env.NodeEnvironment.loadOrCreateNodeMetaData(NodeEn  
> vironment.java:426) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.env.NodeEnvironment.(NodeEnvironment.java:304  
> ) ~[elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.node.Node.(Node.java:278) ~[elasticsearch-7.3  
> .1.jar:7.3.1]  
> at org.elasticsearch.node.Node.(Node.java:258) ~[elasticsearch-7.3  
> .1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[  
> elasticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[ela  
> sticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elas  
> ticsearch-7.3.1.jar:7.3.1]  
> at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159  
> ) ~[elasticsearch-7.3.1.jar:7.3.1]  
> ... 6 more

Regards,  
Priyanka

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 28, 2020, 6:45am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/2 "2020-01-28T06:45:54Z")

</div>

The error is:

> cannot downgrade a node from version [7.4.2] to version [7.3.1]

Why do you want to mix versions?

---

<div class="post-metadata">

**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Post date:** [January 28, 2020, 6:49am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/3 "2020-01-28T06:49:18Z")

</div>

Hello @dadoonet,

Actually es cluster version is 7.4.2 and my indexes are created on older version. (7.3.1).  
I am trying logstash jdbc input plugin to create new indexes from db in new cluster version. but i am getting error there.

So i am trying to start es services for older version.

Regards,  
Priyanka

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 28, 2020, 7:13am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/4 "2020-01-28T07:13:11Z")

</div>

You can't downgrade.

> [@pyerunka](#):
>
> but i am getting error there.

May be share what the real problem is ?

---

<div class="post-metadata">

**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Post date:** [January 28, 2020, 7:24am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/5 "2020-01-28T07:24:24Z")

</div>

Hello @dadoonet,

I am getting below error when i am trying to start logstash from new es version (7.4.2):

> E:\logstash-7.4.2\bin\>logstash -f Master.conf  
> Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was depreca  
> ted in version 9.0 and will likely be removed in a future release.  
> WARNING: An illegal reflective access operation has occurred  
> WARNING: Illegal reflective access by org.jruby.runtime.encoding.EncodingService  
> (file:/E:/logstash-7.4.2/logstash-core/lib/jars/jruby-complete-9.2.8.0.jar) to  
> field java.io.Console.cs  
> WARNING: Please consider reporting this to the maintainers of org.jruby.runtime.  
> encoding.EncodingService  
> WARNING: Use --illegal-access=warn to enable warnings of further illegal reflect  
> ive access operations  
> WARNING: All illegal access operations will be denied in a future release  
> Thread.exclusive is deprecated, use Thread::Mutex  
> Sending Logstash logs to E:/logstash-7.4.2/logs which is now configured via log4  
> j2.properties  
> [2020-01-28T07:19:51,282][WARN][logstash.config.source.multilocal] Ignoring the  
> 'pipelines.yml' file because modules or command line options are specified  
> [2020-01-28T07:19:51,294][INFO][logstash.runner] Starting Logstash {"  
> logstash.version"=\>"7.4.2"}  
> [2020-01-28T07:19:52,834][INFO][org.reflections.Reflections] Reflections took 4  
> 0 ms to scan 1 urls, producing 20 keys and 40 values  
> [2020-01-28T07:19:53,146][ERROR][logstash.agent] Failed to execute ac  
> tion {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"J  
> ava::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: I  
> llegal character in opaque part at index 5: http:\\localhost:9200", :backt  
> race=\>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:100  
> )", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.j  
> ava:60)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.c  
> all(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runt  
> ime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.run  
> time.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1156)", "org.jruby.ir.  
> runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1143)", "o  
> rg.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:  
> 39)", "E\_3a\_.logstash\_minus\_7\_dot\_4\_dot\_2.logstash\_minus\_core.lib.logstash.java\_  
> pipeline.RUBY$method$initialize$0(E:/logstash-7.4.2/logstash-core/lib/logstash/j  
> ava\_pipeline.rb:26)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(  
> CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMetho  
> d.call(MixedModeIRMethod.java:90)", "org.jruby.runtime.callsite.CachingCallSite.  
> cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCall  
> Site.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.  
> java:915)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$  
> newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)"  
> , "E\_3a\_.logstash\_minus\_7\_dot\_4\_dot\_2.logstash\_minus\_core.lib.logstash.pipeline\_  
> action.create.RUBY$method$execute$0(E:/logstash-7.4.2/logstash-core/lib/logstash  
> /pipeline\_action/create.rb:36)", "E\_3a\_.logstash\_minus\_7\_dot\_4\_dot\_2.logstash\_mi  
> nus\_core.lib.logstash.pipeline\_action.create.RUBY$method$execute$0$ **VARARGS** (E  
> :/logstash-7.4.2/logstash-core/lib/logstash/pipeline\_action/create.rb)", "org.jr  
> uby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "  
> org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java  
> :90)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)", "E\_3a\_.log  
> stash\_minus\_7\_dot\_4\_dot\_2.logstash\_minus\_core.lib.logstash.agent.RUBY$block$conv  
> erge\_state$2(E:/logstash-7.4.2/logstash-core/lib/logstash/agent.rb:326)", "org.j  
> ruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136)", "org  
> .jruby.runtime.IRBlockBody.call(IRBlockBody.java:77)", "org.jruby.runtime.Block.  
> call(Block.java:129)", "org.jruby.RubyProc.call(RubyProc.java:295)", "org.jruby.  
> RubyProc.call(RubyProc.java:274)", "org.jruby.RubyProc.call(RubyProc.java:270)",  
> "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.bas  
> e/java.lang.Thread.run(Thread.java:834)"]}  
> warning: thread "Converge PipelineAction::Create" terminated with exceptio  
> n (report\_on\_exception is true):  
> LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException ` for `PipelineAction::Create<main>`  
> create at org/logstash/execution/ConvergeResultExt.java:109  
> add at org/logstash/execution/ConvergeResultExt.java:37  
> converge\_state at E:/logstash-7.4.2/logstash-core/lib/logstash/agent.rb:339  
> [2020-01-28T07:19:53,170][ERROR][logstash.agent] An exception happene  
> d when converging configuration {:exception=\>LogStash::Error, :message=\>"Don't k  
> now how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::C reate<main>`", :backtrace=\>["org/logstash/execution/ConvergeResultExt.java:109:i  
> n `create'", "org/logstash/execution/ConvergeResultExt.java:37:in `add'", "E:/lo  
> gstash-7.4.2/logstash-core/lib/logstash/agent.rb:339:in `block in converge_state '"]} [2020-01-28T07:19:53,354][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2020-01-28T07:19:53,422][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::  
> IllegalStateException`for`PipelineAction::Create`>, :backtrace=>["org/lo gstash/execution/ConvergeResultExt.java:109:in `create'", "org/logstash/executio  
> n/ConvergeResultExt.java:37:in `add'", "E:/logstash-7.4.2/logstash-core/lib/logs tash/agent.rb:339:in `block in converge\_state'"]}  
> [2020-01-28T07:19:53,558][ERROR][org.logstash.Logstash] java.lang.IllegalSta  
> teException: Logstash stopped processing because of an error: (SystemExit) exit

Regards,  
Priyanka

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 28, 2020, 9:00am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/6 "2020-01-28T09:00:36Z")

</div>

Please format your code, logs or configuration files using `</>` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable.

Or use markdown style like:

````
```
CODE
```

````

This is the icon to use if you are not using markdown format:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e6e239431ec2d71cbf1beef741f2e93e7cc762c.jpg)

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.  
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.  
Please update your post.

Does the problem happen with LS 7.3.1? If not, I think you can always connect LS 7.3 to ES 7.4. Although I'd not really recommend it.

Then, I'd suggest that you ask about the Logstash problem specifically in #logstash or move your question there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 9:00am UTC](https://discuss.elastic.co/t/main-error-esjsonlayout-contains-an-invalid-element-or-a-ttribute-esmessagefields/216752/7 "2020-02-25T09:00:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.