# Upgraded ES 5.6 \> 6.1 Now \_bulk not accepting header text/json

**URL:** <https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448>\
**Category:** Elasticsearch\
**Created:** [December 19, 2017, 2:13pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448 "2017-12-19T14:13:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericohtake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericohtake/32/24539_2.png) [@ericohtake](https://discuss.elastic.co/u/ericohtake)\
**Post date:** [December 19, 2017, 2:13pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/1 "2017-12-19T14:13:48Z")

</div>

Hello,  
Today we updated ES to version 6.1 coming from 5.6 and all went good except for indexing Linux logs via a RSYSLOG plugin called omelasticsearch. I've setup an error output file that tells that the Content-Type header text/json is not supported. Is there any change thay might be causing this problem? I mean, propably the maintainer of this plugin will have to change its configuration somehow.

Below the response the application is getting from Elasticsearch after posting that data using the \_bulk api. I had the syslog not being delivered after the upgrade, and only. All the rest are working fine.

```
{
        "request": {
                "url": "http://elasticsearch:9200/_bulk",
                "postdata": "{\"index\":{\"_index\": \"rsyslog-2017-12-19\",\"_type\":\"syslog\"}}\n{\"timestamp\":\"2017-12-19T22:31:29+09:00\",\"message\":\" Starting Session 57613 of user root.\",\"host\":\"somehost\",\"severity\":\"info\",\"facility\":\"daemon\",\"syslogtag\":\"systemd:\"}\n"
        },
        "reply": {
                "error": "Content-Type header [text/json; charset=utf-8] is not supported",
                "status": 406
        }
}

```

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\
**Post date:** [December 19, 2017, 2:41pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/2 "2017-12-19T14:41:12Z")

</div>

It should be `Content-Type: application/json` (the UTF-8 option is fine too).

---

<div class="post-metadata">

**Author:** ![ericohtake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericohtake/32/24539_2.png) [@ericohtake](https://discuss.elastic.co/u/ericohtake)\
**Post date:** [December 19, 2017, 11:54pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/3 "2017-12-19T23:54:43Z")

</div>

Thank you Jason. There was a specific change in place that made ES not accept what this plugin was sending to version 5.6?

---

<div class="post-metadata">

**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\
**Post date:** [December 20, 2017, 12:41am UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/4 "2017-12-20T00:41:20Z")

</div>

Yes. See our blog post on [strict content-type header parsing](https://www.elastic.co/blog/strict-content-type-checking-for-elasticsearch-rest-requests).

---

<div class="post-metadata">

**Author:** ![ericohtake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericohtake/32/24539_2.png) [@ericohtake](https://discuss.elastic.co/u/ericohtake)\
**Post date:** [December 20, 2017, 11:57am UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/5 "2017-12-20T11:57:00Z")

</div>

Thank you Jason. My bad, ,it seems that this change is up for some time already, and I've just noticed it upon upgrading to 6.1.  
This post clarifies all. It seems there is a fix on 8.30 version of RSYSLOG, but it is still not in the RHEL repositories, we will update it manually.

---

<div class="post-metadata">

**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\
**Post date:** [December 20, 2017, 12:10pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/6 "2017-12-20T12:10:46Z")

</div>

You're welcome!

---

<div class="post-metadata">

**Author:** ![ericohtake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericohtake/32/24539_2.png) [@ericohtake](https://discuss.elastic.co/u/ericohtake)\
**Post date:** [December 20, 2017, 1:03pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/7 "2017-12-20T13:03:57Z")

</div>

Well, for those interested, don't update RSYSLOG just yet. It seems there is a nasty bug in the omelasticsearch module that need to have the fix pushed.

> <https://github.com/rsyslog/rsyslog/issues/1885>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2018, 1:03pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448/8 "2018-01-17T13:03:57Z")

</div>

Closed on January 17, 2018, 1:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.