1

I'm using Powershell (via Cmder) along with curl (GoW) to create an index template in elasticsearch.

Here's my curl:

curl -XPUT http://myAddress:9200/_template/logstash_per_iis -u user:password -d' 
{
    "template" : "logstash*",
    "mappings" : {
      "iis" : {
        "properties" : {
            "response":{"type":"int"},
            "site":{"type":"ip"},
            "supresponse":{"type":"int"},
            "time_taken":{"type":"int"},
            "clientHost":{"type":"ip"},
            "port":{"type":"int"},
            "scstatus":{"type":"int"}
        }
      }
    }
}
'

Here's the response from ES:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "failed to parse template source"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "failed to parse template source",
    "caused_by": {
      "type": "json_parse_exception",
      "reason": "Unrecognized token 'logstash': was expecting ('true', 'false' or 'null')\n at [Source: [B@38a6a400; line: 3, column: 25]"
    }
  },
  "status": 400
}

ES is stating a json_parse_exception, however, I cannot figure out where my JSON package is invalid.

What is wrong with my JSON or am I doing something else incorrectly?

3
  • It's weird, I could execute that exact curl command (after replacing myAddress with localhost) on both ES 1.x and ES 2.x clusters without any problem (on MacOS). Commented Jan 4, 2016 at 19:18
  • @Val, I should have noted more explicitly that I'm on windows. Looks like the answer is I needed """ vs ". Thanks for your time, though. Much appreciated. Commented Jan 4, 2016 at 19:19
  • No prob, I'll leave my comment for the Mac folks landing on this question ;) Commented Jan 4, 2016 at 19:20

1 Answer 1

2

Turns out curl on windows needs """ instead of just ".

Found the answer from this question: https://stackoverflow.com/a/27761856/899048

So, my curl ends up looking like this:..

curl -XPUT http://myAddress:9200/_template/logstash_per_iis -u user:password -d' 
{
    """template""" : """logstash*"""
    """mappings""" : {
      """iis""" : {
          """response""":{"""type""":"""int"""},
          """site""":{"""type""":"""ip"""},
          """supresponse""":{"""type""":"""int"""},
          """time_taken""":{"""type""":"""int"""},
          """clientHost""":{"""type""":"""ip"""},
          """port""":{"""type""":"""int"""},
          """scstatus""":{"""type""":"""int"""}
      }
    }
}
'

Looks horrible, but it worked.

Sign up to request clarification or add additional context in comments.

1 Comment

One of the comments on that question mentions \", which works for me and looks better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.