ES Output failed with code 400

[root-secure]

@jordansissel

Similar to the discussion in #144 , is it possible to change the error message to be much more succinct/clear about the reason for the failed insert? In my case, it wasn't a uppercase index problem, but a template type problem. I ended up having to delete the the template and all indicies using it in order to be able to insert again. It would great if this error log could be:

1. ~1 line long
2. provide clarity around why the insert failed (index has caps, type mismatch on field X, etc)
3. Reccomended way to solve (ensure no caps in index, run "XYZ" to update template type if desired, etc)

For reference:

ES Version:
{ "status" : 200, "name" : "Torso", "cluster_name" : "elasticsearch", "version" : { "number" : "1.6.0", "build_hash" : "cdd3ac4dde4f69524ec0a14de3828cb95bbb86d0", "build_timestamp" : "2015-06-09T13:36:34Z", "build_snapshot" : false, "lucene_version" : "4.10.4" }, "tagline" : "You Know, for Search" }
Logstash version:
# /opt/logstash/bin/logstash -V
logstash 1.5.4

[yodog]

had the same problem yesterday.
and logstash.log was generating 1G of logs per minute.

it all happened because i turned on numeric_detection.
setting it back to false (the default) AND deleting the index solved the issue.

PS: just setting it back to false, without deleting the index will NOT resolve the problem.

"numeric_detection" : false

[jsvd]

The current logging entry is:

@logger.warn "Could not index event to Elasticsearch.", status: status, action: action, response: response

which I think is reasonable. Closing this, please open a new issue if you consider there should be more or less information.