# Transform creation error - request body is required

**URL:** <https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394>\
**Category:** Kibana\
**Created:** [November 12, 2025, 1:26pm UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394 "2025-11-12T13:26:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [November 12, 2025, 1:26pm UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/1 "2025-11-12T13:26:49Z")

</div>

Hi community,

I was looking to create a transform to show count of documents aggregated over unique syslog hostnames. So I proceeded to create the transform through the Kibana GUI and encountered an error: `Internal Server Error: An internal server error occurred. Check Kibana server logs for details.`

While revieving the Kibana logs through my dedicated monitoring instance all I could see was `Cannot destructure property 'error' of '{}' as it is undefined.` . So this wasn't any useful at all.

I copied the request and added `?error_trace=true` to the URL and I got this stack trace below with error `request body is required`. **I'm asking for help what is wrong with my transformation attached below?**

Note that the preview looks fine in Kibana when creating the transformation.

Stack is running 8.17.5. I've not encountered issues before creating a transformation.

* * *

**Stacktrace**

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "request body is required",
        "stack_trace": """org.elasticsearch.ElasticsearchParseException: request body is required
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.requiredContent(RestRequest.java:327)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.contentParser(RestRequest.java:536)
	at org.elasticsearch.transform@8.17.5/org.elasticsearch.xpack.transform.rest.action.RestPutTransformAction.prepareRequest(RestPutTransformAction.java:63)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:106)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:504)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:498)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.doHandleRequest(SecurityRestFilter.java:89)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.lambda$intercept$0(SecurityRestFilter.java:81)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListener$2.onResponse(ActionListener.java:257)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.lambda$authenticateAndAttachToContext$3(SecondaryAuthenticator.java:99)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListenerImplementations$ResponseWrappingActionListener.onResponse(ActionListenerImplementations.java:247)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticate(SecondaryAuthenticator.java:109)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticateAndAttachToContext(SecondaryAuthenticator.java:90)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.intercept(SecurityRestFilter.java:75)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:498)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.tryAllHandlers(RestController.java:662)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:341)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.dispatchRequest(AbstractHttpServerTransport.java:488)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.handleIncomingRequest(AbstractHttpServerTransport.java:584)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.incomingRequest(AbstractHttpServerTransport.java:461)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.handlePipelinedRequest(Netty4HttpPipeliningHandler.java:169)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.channelRead(Netty4HttpPipeliningHandler.java:148)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpAggregator.channelRead(Netty4HttpAggregator.java:52)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardData(Netty4HttpHeaderValidator.java:213)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardFullRequest(Netty4HttpHeaderValidator.java:156)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator$1.lambda$onResponse$0(Netty4HttpHeaderValidator.java:128)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
	at io.netty.common@4.1.118.Final/io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at java.base/java.lang.Thread.run(Thread.java:1575)
"""
      }
    ],
    "type": "parse_exception",
    "reason": "request body is required",
    "stack_trace": """org.elasticsearch.ElasticsearchParseException: request body is required
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.requiredContent(RestRequest.java:327)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.contentParser(RestRequest.java:536)
	at org.elasticsearch.transform@8.17.5/org.elasticsearch.xpack.transform.rest.action.RestPutTransformAction.prepareRequest(RestPutTransformAction.java:63)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:106)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:504)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:498)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.doHandleRequest(SecurityRestFilter.java:89)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.lambda$intercept$0(SecurityRestFilter.java:81)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListener$2.onResponse(ActionListener.java:257)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.lambda$authenticateAndAttachToContext$3(SecondaryAuthenticator.java:99)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListenerImplementations$ResponseWrappingActionListener.onResponse(ActionListenerImplementations.java:247)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticate(SecondaryAuthenticator.java:109)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticateAndAttachToContext(SecondaryAuthenticator.java:90)
	at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.intercept(SecurityRestFilter.java:75)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:498)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.tryAllHandlers(RestController.java:662)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:341)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.dispatchRequest(AbstractHttpServerTransport.java:488)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.handleIncomingRequest(AbstractHttpServerTransport.java:584)
	at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.incomingRequest(AbstractHttpServerTransport.java:461)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.handlePipelinedRequest(Netty4HttpPipeliningHandler.java:169)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.channelRead(Netty4HttpPipeliningHandler.java:148)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpAggregator.channelRead(Netty4HttpAggregator.java:52)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardData(Netty4HttpHeaderValidator.java:213)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardFullRequest(Netty4HttpHeaderValidator.java:156)
	at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator$1.lambda$onResponse$0(Netty4HttpHeaderValidator.java:128)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
	at io.netty.common@4.1.118.Final/io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at java.base/java.lang.Thread.run(Thread.java:1575)
"""
  },
  "status": 400
}

```

* * *

**Transformation**

```auto
PUT _transform/syslog-hosts-log-count?error_trace=true
{
  "source": {
    "index": [
      "logs-*"
    ],
    "query": {
      "bool": {
        "filter": [
          {
            "bool": {
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "term": {
                          "tags": {
                            "value": "syslog"
                          }
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                },
                {
                  "bool": {
                    "should": [
                      {
                        "exists": {
                          "field": "log.syslog.hostname"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ]
            }
          }
        ]
      }
    }
  },
  "pivot": {
    "group_by": {
      "log.syslog.hostname": {
        "terms": {
          "field": "log.syslog.hostname"
        }
      },
      "log.source.address": {
        "terms": {
          "field": "log.source.address"
        }
      }
    },
    "aggregations": {
      "first_seen": {
        "min": {
          "field": "@timestamp"
        }
      },
      "syslog_count": {
        "value_count": {
          "field": "@timestamp"
        }
      },
      "last_seen": {
        "max": {
          "field": "@timestamp"
        }
      }
    }
  },
  "frequency": "10m",
  "dest": {
    "index": "syslog-hosts-log-count"
  }
}

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [November 13, 2025, 4:41am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/2 "2025-11-13T04:41:24Z")

</div>

Hello @dot-mike

Executing this transform via DevTools does not give any error.

The error shared by you about "org.elasticsearch.ElasticsearchParseException: request body is required" is received while executing the transform via CURL or DevTools in your environment?

Thanks!!

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [November 13, 2025, 1:56pm UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/3 "2025-11-13T13:56:31Z")

</div>

Hi and thanks for the reply. I'm running this through DevTools.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [November 14, 2025, 8:15am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/4 "2025-11-14T08:15:17Z")

</div>

Thanks for the details.

On 8.17.5 via DevTools it is executing without any error :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/7/0744d9fd33a56fbd73df892498359b3d3d30fe00.png)

Please check elasticsearch is up without issues also the user with which you are trying to execute has the manage\_transform role.

I am trying with elastic user & do not see any issues.

Thanks!!

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [November 14, 2025, 11:00am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/5 "2025-11-14T11:00:48Z")

</div>

@Tortoise much appreicated for testing!! I was not able to drill down to root cause yesterday. I enabled query logging in `Kibana.yml` and found nothing useful. Any advice what would be next step for troubleshooting?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [November 15, 2025, 7:46am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394/6 "2025-11-15T07:46:37Z")

</div>

Hello @dot-mike

I only see that if you do not have the correct JSON in the DevTools i.e. space or new line than we see this error of body is required.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/9/495ca091af5c5b59356e09d03bfe6a8446d51609.png)

If this is not the issue than see index creation is working & issue is with transform ?

```auto
POST test-index/_doc
{
  "test": "hello"
}

```

If it fails via Devtools try to run via CURL as well to understand the issue is with devtools or a reverse proxy strips bodies on PUT/POST:

```auto
curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"test":"hello"}' "https://ELK:443/test-index/_doc"

```

Thanks!!