Dear Team
I am getting below error on Logstash.
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id '4qrUs3oBqKFEAtQHASue'. Preview of field's value: '{hostname=Gauri, os={build=19042.1083, kernel=10.0.19041.1083 (WinBuild.160101.0800), name=Windows 10 Home, type=windows, family=windows, version=10.0, platform=windows}, ip=[fe80::a4a0:65da:2279:abe6, 169.254.171.230, 192.168.10.169, fe80::64d5:dcba:bc1f:39a2, 169.254.57.162, fe80::b8f1:2cd9:84bd:4d07, 169.254.77.7, fe80::5554:5fcb:378a:2a9d, 169.254.42.157, fe80::5065:4bd7:d551:169e, 169.254.22.158, 2001:8f8:172d:ab3d::1000, 2001:8f8:172d:ab3d:4d52:fa49:b16:f18a, 2001:8f8:172d:ab3d:88f8:3b82:c4be:aec2, 2001:8f8:172d:ab3d:8985:ef1:7abc:fe56, 2001:8f8:172d:ab3d:8d38:e24c:9de:51b4, 2001:8f8:172d:ab3d:b433:67de:514:1f63, 2001:8f8:172d:ab3d:b89e:b0f6:41d4:94e2, fe80::4d52:fa49:b16:f18a, 192.168.1.13], name=Gauri, id=e97c350a-4869-4831-9ef3-5eb2930884e3, mac=[e4:e7:49:82:0d:86, 00:ff:68:32:9b:47, 2a:3a:4d:8d:d1:9d, aa:3a:4d:8d:d1:9d, 00:09:0f:fe:00:01, 28:3a:4d:8d:d1:9d], architecture=x86_64}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:377"}}}}}
Logstash.conf entry
# Read input from filebeat by listening to port 5044 on which filebeat will send the data
input {
beats {
type => "test"
port => "5044"
}
}
filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}
}
output {
stdout {
codec => rubydebug
}
# Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["localhost:9200"]
}
}