There is a problem in org.apache.flume.sink.elasticsearch.ElasticSearchDynamicSerializer.getContentBuilder returns incorrect value, in case when Event contains well-formed json (possible as sub-string).
I tried to find origins of the problem, and found this chunk of code (flume-ng-sinks/flume-ng-elasticsearch-sink/src/main/java/org/apache/flume/sink/elasticsearch/ContentBuilderUtil.java):
It makes impossible to send any string, which contains json to elasticsearch sink using this serializer.
Maybe I'm wrong, but what are benefits from decoding, then encoding chunk of json data?
If it really needed, maybe it is possible to add some option to ElasticSearchDynamicSerializer which forces to use ContentBuilderUtil.addSimpleField instead of ContentBuilderUtil.appendField ?
I can volunteer to create patch when will be decided what is the best way to avoid this issue.