Error when sink is connected to ElasticSearch 8.0.0-SNAPSHOT

[thomashoefkens-vw]

A few questions before you begin:

Is this an issue related to the Serilog core project or one of the [sinks]
Sink Elasticsearch

Does this issue relate to a new feature or an existing bug?

• Bug
• New Feature

What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package.
8.4.1

What is the target framework and operating system? See target frameworks & net standard matrix.

• netCore 5.0

Please describe the current behavior?
When connecting to Elastic 7.9.1 logging works fine. Connecting to 8.0 throws this error:

2020-12-11T12:56:03.7531402Z Caught exception while preforming bulk operation to Elasticsearch: Elasticsearch.Net.ElasticsearchClientException: Request failed to execute. Call: Status code 400 from: POST /_bulk. ServerError: Type: illegal_argument_exception Reason: "Action/metadata line [1] contains an unknown parameter [_type]"
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.HandleElasticsearchClientException(RequestData data, Exception clientException, IElasticsearchResponse response)
020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.FinalizeResponse[TResponse](RequestData requestData, IRequestPipeline pipeline, List`1 seenExceptions, TResponse response)
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.RequestAsync[TResponse](HttpMethod method, String path, CancellationToken cancellationToken, PostData data, IRequestParameters requestParameters)
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Serilog.Sinks.Elasticsearch.ElasticsearchSink.EmitBatchAsync(IEnumerable`1 events)
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
2020-12-11T12:56:03.7533834Z Caught exception while emitting to callback System.Action`1[Serilog.Events.LogEvent]: System.NullReferenceException: Object reference not set to an instance of an object.
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Newton.OrderService.Bootstrap.Program.<>c.<Main>b__0_1(LogEvent e) in /home/vsts/work/1/s/Bootstrap/Program.cs:line 34
11.12.2020, 13:56:03
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Serilog.Sinks.Elasticsearch.ElasticsearchSink.HandleException(Exception ex, IEnumerable`1 events)
11.12.2020, 13:56:11
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
2020-12-11T12:56:11.7557969Z Caught exception while preforming bulk operation to Elasticsearch: Elasticsearch.Net.ElasticsearchClientException: Request failed to execute. Call: Status code 400 from: POST /_bulk. ServerError: Type: illegal_argument_exception Reason: "Action/metadata line [1] contains an unknown parameter [_type]"
11.12.2020, 13:56:11
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.HandleElasticsearchClientException(RequestData data, Exception clientException, IElasticsearchResponse response)
11.12.2020, 13:56:11
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.FinalizeResponse[TResponse](RequestData requestData, IRequestPipeline pipeline, List`1 seenExceptions, TResponse response)
11.12.2020, 13:56:11
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Elasticsearch.Net.Transport`1.RequestAsync[TResponse](HttpMethod method, String path, CancellationToken cancellationToken, PostData data, IRequestParameters requestParameters)
11.12.2020, 13:56:11
orderservice-api-745b5975df-2jcbm
b986a1e1f9483f1c4ce20673c607f71eb3608b85ee9b1882f6a0eab169f3a594
at Serilog.Sinks.Elasticsearch.ElasticsearchSink.EmitBatchAsync(IEnumerable`1 events)

Please describe the expected behavior?
No errors posting to the bulk endpoint

If the current behavior is a bug, please provide the steps to reproduce the issue and if possible a minimal demo of the problem

Create a logger and hook it up against Elastic 8.0.0

            Logger = new LoggerConfiguration()  
                .Enrich.FromLogContext()
                .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri("http://elasticsearch-master.elk.svc.cluster.local:9200/"))  
                {  
                    FailureCallback = e => Console.WriteLine("Unable to submit event " + e.MessageTemplate + " Error: " + e.Exception.Message),
                    EmitEventFailure = EmitEventFailureHandling.WriteToSelfLog |
                                       EmitEventFailureHandling.RaiseCallback,
                    AutoRegisterTemplate = true,  
                    IndexFormat = $"{Assembly.GetExecutingAssembly().GetName().Name.ToLower()}-{DateTime.UtcNow:yyyy-MM}",
                    MinimumLogEventLevel = Serilog.Events.LogEventLevel.Verbose
                })
                .Enrich.WithProperty("Environment", environment)  
                .CreateLogger();
            
            Serilog.Debugging.SelfLog.Enable(message => Console.WriteLine(message));

[orjan]

There's not clear way to configure this for Elastic v8 at the moment.
I'm not sure that this will work for you but it's working against Elastic v7.10 that probably will be compatible with v8.
If we're looking at the exception it indicates that we're sending _type that's removed in v8 and deprecated in v7.

"Action/metadata line [1] contains an unknown parameter [_type]"

In 8.4.0 we added a couple of features that eventually will work for you.

TypeName = null,
IndexFormat = "logs-my-stream",
BatchAction = ElasticOpType.Create,

If TypeName = null is set null we'll not pass _type when sending data to Elastic.
Note: I think this is only working with configuration as code.

BatchAction = ElasticOpType.Create is needed to be able to write data to data-streams which is a great improvement over write aliases.

We should probably add the possibility to set the targeted Elastic version to v8 that'll suppress the _type automatically.

[albinsunnanbo]

Elastic v8 is out now, bumping this issue!

[pankof]

TypeName = null,
BatchAction = ElasticOpType.Create,
IndexFormat = "api-local-{ 0:yyyy.MM }"

I tried this config in version 8.4.1 but still getting the error.

[digger73]

Is there active development on this or is the project stalled ? Considering this issue was opened in 2020.

[albinsunnanbo]

On NuGet you have published a version 8.5.0-alpha0003, but I can't find any corresponding release tag in the GitHub repo.
Anyone knows if there are there any significant changes in the 8.5.0 version?
I'll make a try to see if I can make a pull request and solve this issue.

[deMD]

Did get it working with the following options:

options.AutoRegisterTemplate = true;
options.AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7; <-- this was the magic bullet
options.IndexFormat = indexFormat.ToLowerInvariant().Replace(".", "-");
options.BatchAction = ElasticOpType.Create;
options.TypeName = null;

However it the sink still uses index templates that are deprecated in ElasticSearch 8.

[DNDevCode]

I'm using Serilog.Sinks.Elasticsearch 8.4.1 and i am currently encountering the problem.

Is There any way/workaround to set TypeName in appsetting directly, i won't setting it in code anymore

Thank you

[patrikbeno]

Problem is that default typeName="_doc", hence you cannot reset it from json/yaml configuration. It should be null for 8.x stream.

[DNDevCode]

I updating to 9.0.0 beta7 but i get the same exception :

2022-07-06T09:28:57.0491018Z Caught exception while performing bulk operation to Elasticsearch: Elasticsearch.Net.ElasticsearchClientException: Request failed to execute. Call: Status code 400 from: POST /_bulk. ServerError: Type: illegal_argument_exception Reason: "Action/metadata line [1] contains an unknown parameter [_type]"

[ArjunVachhani]

How do I set TypeName to null using environment variable?
If I use null it appears as _type : "null"

[alibaghernejad]

I had the same problem on a Project based on .Net Framework 4.6.1 and .Net Standard 2.0.
Setting the "TypeName" value to null at startup did fix the issue. Here is the configuration. Hope it helps.

Here are some dependency info:
Serilog.Sinks.Elasticsearch version: 8.4.1 (client project: .Net Framework) <---> ElasticSearch version: 8.3.3 (Backend Server)

...
loggerConfig
.Elasticsearch(new ElasticsearchSinkOptions(new Uri(elasticsearchSinkUrl))
{
AutoRegisterTemplate = true,
BatchAction = ElasticOpType.Create,
AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7,
CustomFormatter = new ElasticsearchJsonFormatter(),
FailureCallback = e => Console.WriteLine(e.MessageTemplate + e.RenderMessage()),
EmitEventFailure = EmitEventFailureHandling.RaiseCallback,
IndexFormat = eventLogIndexFormat,
MinimumLogEventLevel = Serilog.Events.LogEventLevel.Debug,

// This fix Http 400 POST /_bulk Error.
// (The remote server returned an error: (400) Bad Request.. Call: Status code 400 from: POST /_bulk)
// Consider upgrading to the new version of Serilog.sinks.elasticsearch when possible. 
TypeName = null,

});

[TobieD]

Experienced the same issue (Opensearch running in a local docker)

Resolution was indeed to add the TypeName = null but I also had to remove the .ReadFrom.AppSettings()

[CyberMonster]

Setting variable TypeName to null fix problem for me. Now in my appsettings:

"WriteTo": [
  {
    "Name": "Elasticsearch",
    "Args": {
      "nodeUris": "http://elasticuser:elasticuserpass@127.0.0.1:9200",
      "indexFormat": "test_index",
      "TypeName":  null
    }
  }
]

elastic 8.4.1 (docker); Serilog.Sinks.Elasticsearch 9.0.0-beta7; Serilog 2.12.0; .Net 6.0; SDK: Version: 6.0.401 Commit: 0906eae6f8

[thargan]

This still is not working for me in the appsettings.json I have tried both "TypeName": null and "typeName": null. I have used the latest Serilog.Sinks.Elasticsearch 9.0.0-beta7

Turns out - for me its only showing up when there is an actual error - I was having an authentication error due to the IAM role not being mapped to an internal user - so it only is happening for me when there is an actual error - this is all i am getting instead of the actual error