Briefly, this error occurs when Elasticsearch is unable to parse the [_source] field in a document. This could be due to incorrect data types, malformed JSON, or a mismatch between the data and the mapping. To resolve this issue, you can: 1) Check the format and data types of your [_source] field to ensure they match the mapping. 2) Validate your JSON to ensure it’s correctly formatted. 3) Update your mapping if the data types have changed. 4) Reindex your data if necessary.
This guide will help you check for common problems that cause the log ” [hit] failed to parse [_source] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: reindex.
Overview
Reindex is the concept of copying existing data from a source index to a destination index which can be inside the same or a different cluster. Elasticsearch has a dedicated endpoint _reindex for this purpose. A reindexing is mostly required for updating mapping or settings.
Examples
Reindex data from a source index to destination index in the same cluster:
POST /_reindex?pretty
{
"source": {
"index": "news"
},
"dest": {
"index": "news_v2"
}
}
Notes
- Reindex API does not copy settings and mappings from the source index to the destination index. You need to create the destination index with the desired settings and mappings before you begin the reindexing process.
- The API exposes an extensive list of configuration options to fetch data from the source index, such as query-based indexing and selecting multiple indices as the source index.
- In some scenarios reindex API is not useful, where reindexing requires complex data processing and data modification based on application logic. In this case, you can write your custom script using Elasticsearch scroll API to fetch the data from source index and bulk API to index data into destination index.
Log Context
Log “[hit] failed to parse [_source]” class name is RemoteResponseParsers.java. We extracted the following from Elasticsearch source code for those seeking an in-depth context :
b.copyCurrentStructure(p);
// a hack but this lets us get the right xcontent type to go with the source
return new Tuple<>(BytesReference.bytes(b); s);
}
} catch (IOException e) {
throw new ParsingException(p.getTokenLocation(); "[hit] failed to parse [_source]"; e);
}
}; new ParseField("_source"));
ParseField routingField = new ParseField("_routing");
ParseField ttlField = new ParseField("_ttl");
ParseField parentField = new ParseField("_parent");
