# Metricbeat to logstash parsing error: illegal\_state\_exception & Can't get text on a START\_OBJECT

**URL:** <https://discuss.elastic.co/t/metricbeat-to-logstash-parsing-error-illegal-state-exception-cant-get-text-on-a-start-object/237035>\
**Category:** Logstash\
**Created:** [June 14, 2020, 6:55pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-parsing-error-illegal-state-exception-cant-get-text-on-a-start-object/237035 "2020-06-14T18:55:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 14, 2020, 6:55pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-parsing-error-illegal-state-exception-cant-get-text-on-a-start-object/237035/1 "2020-06-14T18:55:06Z")

</div>

Hello, I am using the following configuration to get metrics from a Raspebrry Pi (running Raspberry OS) using Metricbeat. It works flawlessly when I send the logs directly to elasticsearch. However, I want to move my ingest load to a dedicated devices running logstash. Whenever I change the output to logstash following is the error I get:

```auto
[2020-06-05T16:09:16,390][WARN][logstash.outputs.elasticsearch][main][563a0d925db00a15e26e2833ed06a38cf68d194b06cb4411456ec679ab0fe6ff] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"gebbs", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x18c02de>], :response=>{"index"=>{"_index"=>"gebbs", "_type"=>"_doc", "_id"=>"O-QQhHIBnvxMCmxROA7n", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'O-QQhHIBnvxMCmxROA7n'. Preview of field's value: '{hostname=financesrv, os={kernel=4.19.97-v7+, codename=buster, name=Raspbian GNU/Linux, family=debian, version=10 (buster), platform=raspbian}, containerized=false, name=financesrv, id=448535ae96d34b1799e964bd3cd3a439, architecture=armv7l}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:903"}}}}}

[2020-06-05T16:09:16,398][WARN][logstash.outputs.elasticsearch][main][563a0d925db00a15e26e2833ed06a38cf68d194b06cb4411456ec679ab0fe6ff] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"gebbs", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x179915d>], :response=>{"index"=>{"_index"=>"gebbs", "_type"=>"_doc", "_id"=>"POQQhHIBnvxMCmxROA7n", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'POQQhHIBnvxMCmxROA7n'. Preview of field's value: '{hostname=financesrv, os={kernel=4.19.97-v7+, codename=buster, name=Raspbian GNU/Linux, family=debian, version=10 (buster), platform=raspbian}, containerized=false, name=financesrv, id=448535ae96d34b1799e964bd3cd3a439, architecture=armv7l}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:873"}}}}}

```

Here is the logstash pipeline configuration:

```auto
input {
  beats {
    port => 5050
  }
}

output {
        elasticsearch {
            hosts => ["https://IP of elasticsearch:9200"]
            ssl => true
            user => 'ID'
            password => 'password'
            cacert => '/etc/logstash/elasticsearch-ca.pem'
            ssl_certificate_verification => false
            ilm_enabled => auto
            ilm_rollover_alias => "rpi-metricbeat"
            index => "%{[@metadata][beat]}-%{[@metadata][version]}"
        }
        #file {
        # path => "/tmp/cowrie-logstash.log"
        # codec => json
        #}
        #stdout {
            #codec => rubydebug
        #}
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 14, 2020, 7:40pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-parsing-error-illegal-state-exception-cant-get-text-on-a-start-object/237035/2 "2020-06-14T19:40:39Z")

</div>

Read [this](https://discuss.elastic.co/t/logstash-errors-mapper-parsing-exception-vs-illegal-argument-exception/236783/3) post and then [this](https://discuss.elastic.co/t/problem-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch-wazuh-alerts-3-x-2020-05-30/235038/6) post.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2020, 7:40pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-parsing-error-illegal-state-exception-cant-get-text-on-a-start-object/237035/3 "2020-07-12T19:40:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.