# Indexer Failure: Can't get text on a START\_OBJECT

**URL:** <https://community.graylog.org/t/indexer-failure-cant-get-text-on-a-start-object/28787>\
**Category:** Graylog Central (peer support)\
**Created:** [May 13, 2023, 1:37am UTC](https://community.graylog.org/t/indexer-failure-cant-get-text-on-a-start-object/28787 "2023-05-13T01:37:48Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [May 13, 2023, 3:54am UTC](https://community.graylog.org/t/indexer-failure-cant-get-text-on-a-start-object/28787/6 "2023-05-13T03:54:38Z")

</div>

Hey @erasedhammer

> [@erasedhammer](#):
>
> How can I extract JSON objects and arrays that may or may not be present in the ingested logs?

That would be beyond my capabilities, But when some issues arise like another device sending log into INPUT and they all go to the same index set, easy way would build out the inputs for different devices that would go into their own index set. For example Firewall log go into input called "Firewall /w syslog/UDP”, then route them into index set called firewall logs. Think you get the point.  
This will avoid mapping conflicts down the road. This will alos avoid errors called

```auto
 ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=Limit of total fields [1000] has been exceeded]]

```

Unless you have a custom index templates, Elasticsearch/OpenSearch will dynamically map anything it can.

As for JSON pipeline you may want to try to flatten it.

Example from here.

> [@Parsing nested json message in field with parent object in pipeline](https://community.graylog.org/t/parsing-nested-json-message-in-field-with-parent-object-in-pipeline/26292/9):
>
> Have you experimented with flatten\_json? Here’s a source and example with something I did to bring in logs into my test system. rule "Random User Data Flatten Json Rule" // From sample data : https://randomuser.me/api/ // Api input path: \* when true then let sJson = to\_string($message.result); let sJson = regex\_replace( pattern: "^\\[|\\]$", value: sJson, replacement: "" ); let rsJson = flatten\_json(to\_string(sJson), "flatten"); set\_fields(to…

EDIT @erasedhammer i for got to metion , perhaps use a key value, something like this…

> [@Issue with Key=Value Parser Pipeline for specific log-messages](https://community.graylog.org/t/issue-with-key-value-parser-pipeline-for-specific-log-messages/19606/2):
>
> Try to use this, I’ve added parameters to remove "{} from key and values. But, it’s not perfect, because of Country contains json. rule "key\_value\_parser" when has\_field("Full\_Response") then set\_fields( fields: key\_value( value: to\_string($message.Full\_Response), delimiters:",", kv\_delimiters:":", trim\_key\_chars:"\"", trim\_value\_chars: "\"{}") ); end

---

_[View the full topic](https://community.graylog.org/t/indexer-failure-cant-get-text-on-a-start-object/28787)._