reason=>"Can't get text on a START_OBJECT

Trying to route logs from a local machine to a logstash server in GCP, which then goes to elasticsearch as part of elastic cloud. Looks like this connection is breaking down trying to write to elasticsearch, but that isnt happening for other data sources.

The [WARN] from Logstash:

[2018-09-08T19:04:08,147][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.09.08", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x413ae246>], :response=>{"index"=>{"_index"=>"logstash-2018.09.08", "_type"=>"doc", "_id"=>"27KRumUBR3JTVwE35DjE", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:130"}}}}}

Please google the error message. This has been discussed here and in GitHub issues many times before.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.