Access arrays in array

Elastic Stack Logstash
1

Hi all,

I have a nested field with arrays in array in JSON like the following:

{
	"foo": {
		"bar": [
			[
				"a",
				"b"
			],
			[
				"c",
				"d"
			]
		]
	}
}

The following is my config file:

input {
	file {
		codec => "json"
		path => "pathtofile"
		type => "footype"
		start_position => "beginning"
	}
}
filter {
	json {
		source => "message"
		remove_field => [ "host", "message", "path" ]
	}
}
output {
	elasticsearch {
		action => "index"
		index => "bar"
		hosts => [ "http://localhost:9200" ]
	}
}

I got the following error:

09:40:47.725 [[main]>worker0] WARN logstash.outputs.elasticsearch - Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"bar", :_type=>"footype", :_routing=>nil}, 2017-02-13T01:40:30.387Z myconnection %{message}], :response=>{"index"=>{"_index"=>"bar", "_type"=>"footype", "_id"=>"AVo1IN0vK2jgwdCXqZ-q", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [foo.bar] of different type, current_type [long], merged_type [text]"}}}}

I have a feeling that it's the array problem. I have done some research and know that array is not well supported. But I need to ingest the array in elasticsearch. Is there a way to actually do that?

Any helps will be appreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.