# Some logs not work with elasticsearch
**URL:** https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182
**Category:** Elasticsearch
**Created:** [August 2, 2022, 7:56am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182 "2022-08-02T07:56:33Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@White\_Hat](https://discuss.elastic.co/u/White_Hat)
#### Post date: [August 2, 2022, 7:56am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/1 "2022-08-02T07:56:33Z")
I have two logs:
```auto
{"message":"hello","context":{"user_id":"xxxxxx","error":{"ERROR":"Invalid x or y"}},"level":400,"level_name":"ERROR","channel":"production","datetime":"2022-08-02T11:59:02.238022+04:30","extra":{}}
```
and
```auto
{"message":"hello2","context":{"arr":{"ERROR":"Invalid x or y"},"w":"wwwwww","x":"xxxxxx","y":"yyyyyyy","user_id":"xxxxx"},"level":200,"level_name":"INFO","channel":"production","datetime":"2022-08-02T12:08:57.528514+04:30","extra":{}}
```
I cannot see the first log, but the second log can be shown in kibana.
anyone has an idea?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2022, 8:13am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/2 "2022-08-02T08:13:50Z")
You need to provide a bit more information please.
How are you indexing things to Elasticsearch?
---
### Author:  [@White\_Hat](https://discuss.elastic.co/u/White_Hat)
#### Post date: [August 2, 2022, 8:18am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/3 "2022-08-02T08:18:13Z")
I'm using beats and logstash with simple json filter:
```auto
filter {
json {
source => "message"
target => "message"
}
}
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2022, 8:27am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/4 "2022-08-02T08:27:11Z")
Ok, does Logstash report an error for that event?
---
### Author:  [@White\_Hat](https://discuss.elastic.co/u/White_Hat)
#### Post date: [August 2, 2022, 9:39am UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/5 "2022-08-02T09:39:11Z")
I found the problem:
I cannot use ERROR.ERROR
I must rename the inner ERROR
but I don't know how!
---
### Author:  [@White\_Hat](https://discuss.elastic.co/u/White_Hat)
#### Post date: [August 2, 2022, 12:09pm UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/6 "2022-08-02T12:09:45Z")
I just rename the ERROR field and now everything is OK.
```auto
mutate {
rename => { "[message][context][error]" => "[message][context][prr]" }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2022, 12:10pm UTC](https://discuss.elastic.co/t/some-logs-not-work-with-elasticsearch/311182/7 "2022-08-30T12:10:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.