elasticsearch-ruby: HTTP 400 in scroll API

Using the scroll API as explained

r = client.search index: 'test', scroll: '1m', body: {sort: ['_doc']}
while r = client.scroll(scroll_id: r['_scroll_id'], scroll: '5m') and not r['hits']['hits'].empty? do ...

an error occurred (status 400, Bad request, Cannot get xcontent for unknown type)

It occurs only in our production cluster (ES 5.2.2) secured with x-pack. Cannot replicate it in devel environment (without security it works fine).

I fixed it wrapping scroll_id into body parameter while calling scroll, as follows:

while r = client.scroll(scroll: '5m', body: {scroll_id: r['_scroll_id']}) and not r['hits']['hits'].empty? do ...

That works fine because (see here)

r = client.scroll(scroll: '5m', body: {scroll_id: r['_scroll_id']})

produces

2017-03-09 09:46:00 +0100: GET https://USER:PWD@URL//_search/scroll?scroll=5m [status:200, request:0.146s, query:0.022s]
2017-03-09 09:46:00 +0100: > {"scroll_id":"$$28$$$$AHdBzPgTqV9AN49_kD3CSQH45tI=DnF1ZXJ5VGhlbkZldGNoHgAAAAAAAbVzFjlyWXJGalZ0VHhTTW1Pb1ppQVo5aUEAAAAAAAA74BZQME9iWTc3ZVFaaVFIZkdJZVlGQzJRAAAAAAAAO8UWRU5wcm1DeHJUQnlrWDhkb3d4dndkZwAAAAAAADvWFjNRTXJXTXdlU0ZxUU11QUZuUmhkQ0EAAAAAAAA74RZQME9iWTc3ZVFaaVFIZkdJZVlGQzJRAAAAAAAAO9UWM1FNcldNd2VTRnFRTXVBRm5SaGRDQQAAAAAAADu1FjlmRVFXNFJfUlpTa2JjWGtmRllSLUEAAAAAAAG1dRY5cllyRmpWdFR4U01tT29aaUFaOWlBAAAAAAAAO64WN25VNUt4T3BTeFdvS2laRjgtTXJuQQAAAAAAAbV0FjlyWXJGalZ0VHhTTW1Pb1ppQVo5aUEAAAAAAAA7thY5ZkVRVzRSX1JaU2tiY1hrZkZZUi1BAAAAAAABtXYWOXJZckZqVnRUeFNNbU9vWmlBWjlpQQAAAAAAAbWIFnN3S3hKM2FFUU0yaWY1b0EyMlNpaWcAAAAAAAA71hZCekRudVhWOVFBUzZEcTVBemt3Zy1nAAAAAAABtXcWOXJZckZqVnRUeFNNbU9vWmlBWjlpQQAAAAAAADvDFkVOcHJtQ3hyVEJ5a1g4ZG93eHZ3ZGcAAAAAAAA7xxZFTnBybUN4clRCeWtYOGRvd3h2d2RnAAAAAAAAO8QWRU5wcm1DeHJUQnlrWDhkb3d4dndkZwAAAAAAADvGFkVOcHJtQ3hyVEJ5a1g4ZG93eHZ3ZGcAAAAAAAG1iRZzd0t4SjNhRVFNMmlmNW9BMjJTaWlnAAAAAAABtYsWc3dLeEozYUVRTTJpZjVvQTIyU2lpZwAAAAAAAbWKFnN3S3hKM2FFUU0yaWY1b0EyMlNpaWcAAAAAAAA7yBZFTnBybUN4clRCeWtYOGRvd3h2d2RnAAAAAAAAO64WaW1hbmJXNC1RZGVHMEpCSWVqTXFVdwAAAAAAADvQFjBIRGVWSFlyVDk2QnVtakNQQ053MUEAAAAAAAA7zhYwSERlVkhZclQ5NkJ1bWpDUENOdzFBAAAAAAAAO9MWMEhEZVZIWXJUOTZCdW1qQ1BDTncxQQAAAAAAADvPFjBIRGVWSFlyVDk2QnVtakNQQ053MUEAAAAAAAA70RYwSERlVkhZclQ5NkJ1bWpDUENOdzFBAAAAAAAAO9IWMEhEZVZIWXJUOTZCdW1qQ1BDTncxQQ=="}

where he request body is a HASH {scroll_id: value}

While

r = client.scroll(scroll_id: r['_scroll_id'], scroll: '5m')

produces a

2017-03-09 09:22:37 +0100: GET https://USER:PWD@URL/_search/scroll?scroll=5m [status:400, request:0.077s, query:N/A]
2017-03-09 09:22:37 +0100: > $$28$$$$Ze_mvA3jHBEnU8hJ4zKITkHn8X4=DnF1ZXJ5VGhlbkZldGNoHgAAAAAAAbOwFjlyWXJGalZ0VHhTTW1Pb1ppQVo5aUEAAAAAAAA7MRZQME9iWTc3ZVFaaVFIZkdJZVlGQzJRAAAAAAAAOxUWRU5wcm1DeHJUQnlrWDhkb3d4dndkZwAAAAAAADskFjNRTXJXTXdlU0ZxUU11QUZuUmhkQ0EAAAAAAAA7MBZQME9iWTc3ZVFaaVFIZkdJZVlGQzJRAAAAAAAAOyUWM1FNcldNd2VTRnFRTXVBRm5SaGRDQQAAAAAAADsDFjlmRVFXNFJfUlpTa2JjWGtmRllSLUEAAAAAAAGzshY5cllyRmpWdFR4U01tT29aaUFaOWlBAAAAAAAAOv4WN25VNUt4T3BTeFdvS2laRjgtTXJuQQAAAAAAAbOxFjlyWXJGalZ0VHhTTW1Pb1ppQVo5aUEAAAAAAAA7BBY5ZkVRVzRSX1JaU2tiY1hrZkZZUi1BAAAAAAABs7QWOXJZckZqVnRUeFNNbU9vWmlBWjlpQQAAAAAAAbPGFnN3S3hKM2FFUU0yaWY1b0EyMlNpaWcAAAAAAAA7JhZCekRudVhWOVFBUzZEcTVBemt3Zy1nAAAAAAABs7MWOXJZckZqVnRUeFNNbU9vWmlBWjlpQQAAAAAAADsWFkVOcHJtQ3hyVEJ5a1g4ZG93eHZ3ZGcAAAAAAAA7EhZFTnBybUN4clRCeWtYOGRvd3h2d2RnAAAAAAAAOxcWRU5wcm1DeHJUQnlrWDhkb3d4dndkZwAAAAAAADsTFkVOcHJtQ3hyVEJ5a1g4ZG93eHZ3ZGcAAAAAAAGzxRZzd0t4SjNhRVFNMmlmNW9BMjJTaWlnAAAAAAABs8QWc3dLeEozYUVRTTJpZjVvQTIyU2lpZwAAAAAAAbPHFnN3S3hKM2FFUU0yaWY1b0EyMlNpaWcAAAAAAAA7FBZFTnBybUN4clRCeWtYOGRvd3h2d2RnAAAAAAAAOv4WaW1hbmJXNC1RZGVHMEpCSWVqTXFVdwAAAAAAADseFjBIRGVWSFlyVDk2QnVtakNQQ053MUEAAAAAAAA7HRYwSERlVkhZclQ5NkJ1bWpDUENOdzFBAAAAAAAAOx8WMEhEZVZIWXJUOTZCdW1qQ1BDTncxQQAAAAAAADshFjBIRGVWSFlyVDk2QnVtakNQQ053MUEAAAAAAAA7IBYwSERlVkhZclQ5NkJ1bWpDUENOdzFBAAAAAAAAOyIWMEhEZVZIWXJUOTZCdW1qQ1BDTncxQQ==

where request body is just the value of scroll_id