# Watcher not able to post bulk data into elastic

**URL:** <https://discuss.elastic.co/t/watcher-not-able-to-post-bulk-data-into-elastic/100925>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 18, 2017, 7:46pm UTC](https://discuss.elastic.co/t/watcher-not-able-to-post-bulk-data-into-elastic/100925 "2017-09-18T19:46:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![umeshbt](https://avatars.discourse-cdn.com/v4/letter/u/e68b1a/32.png) [@umeshbt](https://discuss.elastic.co/u/umeshbt)\
**Post date:** [September 18, 2017, 7:46pm UTC](https://discuss.elastic.co/t/watcher-not-able-to-post-bulk-data-into-elastic/100925/1 "2017-09-18T19:46:58Z")

</div>

I am facing one issue watcher watcher,

I have a query which returns list of “servername” and “datatype”

{"Servername":"2","datatype":"AuditJobBacklog"}  
{"Servername":"3","datatype":"AuditJobBacklog"}

I want to insert this data back to elasticsearch using bulk insert(I am using Kibana DevTools).

When I tried with post it works fine,  
POST statuslogs/messages/\_bulk  
{"index":{}}  
{"Servername":"2","datatype":"AuditJobBacklog"}  
{"index":{}}  
{"Servername":"3","datatype":"AuditJobBacklog"}

Same this I am trying to pass in watcher action  
"actions": {  
"elastic\_webhook": {  
"webhook": {  
"method": "POST",  
"host": "localhost",  
"port": 9200,  
"path": "statuslogs/messages/\_bulk",  
"headers": {  
"Accept": "application/json",  
"Content-Type": "application/json"  
},  
"auth": {  
"basic": {  
"username": "elastic",  
"password": "changeme"  
}  
},  
"body": """{"index":{}}\n{"Servername":"2","datatype":"AuditJobBacklog"}\n{"index":{}}\n{"Servername":"3","datatype":"AuditJobBacklog"}\n\n"""  
}  
}  
}

when it gets executed it is throwing an error  
"body": """{"error":{"root\_cause":[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: no requests added;"}],"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: no requests added;"},"status":400}"""

I read blobs about this error, in most of the places error caused because of newline. I tried many ways by putting newline in different places. Still I am not able to post the data.

With single data I am able to send to elastic. I am facing problem with bulk insert.

Please help me in solving this issue.

Thanks  
Umesh

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 2, 2017, 12:53pm UTC](https://discuss.elastic.co/t/watcher-not-able-to-post-bulk-data-into-elastic/100925/2 "2017-10-02T12:53:25Z")

</div>

Instead of creating a bulk request yourself you can use the `index` action, which already supports indexing several documents.

See the docs about multi document support: [https://www.elastic.co/guide/en/x-pack/5.6/actions-index.html#anatomy-actions-index-multi-doc-support](https://www.elastic.co/guide/en/x-pack/5.6/actions-index.html#anatomy-actions-index-multi-doc-support)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2017, 12:53pm UTC](https://discuss.elastic.co/t/watcher-not-able-to-post-bulk-data-into-elastic/100925/3 "2017-10-30T12:53:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.