Ailed to parse field [host] of type [text] in document with id

Elastic Stack Logstash
1

Dear Team

I am getting below error on Logstash.

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id '4qrUs3oBqKFEAtQHASue'. Preview of field's value: '{hostname=Gauri, os={build=19042.1083, kernel=10.0.19041.1083 (WinBuild.160101.0800), name=Windows 10 Home, type=windows, family=windows, version=10.0, platform=windows}, ip=[fe80::a4a0:65da:2279:abe6, 169.254.171.230, 192.168.10.169, fe80::64d5:dcba:bc1f:39a2, 169.254.57.162, fe80::b8f1:2cd9:84bd:4d07, 169.254.77.7, fe80::5554:5fcb:378a:2a9d, 169.254.42.157, fe80::5065:4bd7:d551:169e, 169.254.22.158, 2001:8f8:172d:ab3d::1000, 2001:8f8:172d:ab3d:4d52:fa49:b16:f18a, 2001:8f8:172d:ab3d:88f8:3b82:c4be:aec2, 2001:8f8:172d:ab3d:8985:ef1:7abc:fe56, 2001:8f8:172d:ab3d:8d38:e24c:9de:51b4, 2001:8f8:172d:ab3d:b433:67de:514:1f63, 2001:8f8:172d:ab3d:b89e:b0f6:41d4:94e2, fe80::4d52:fa49:b16:f18a, 192.168.1.13], name=Gauri, id=e97c350a-4869-4831-9ef3-5eb2930884e3, mac=[e4:e7:49:82:0d:86, 00:ff:68:32:9b:47, 2a:3a:4d:8d:d1:9d, aa:3a:4d:8d:d1:9d, 00:09:0f:fe:00:01, 28:3a:4d:8d:d1:9d], architecture=x86_64}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:377"}}}}}

Logstash.conf entry

# Read input from filebeat by listening to port 5044 on which filebeat will send the data
input {
    beats {
	    type => "test"
        port => "5044"
    }
}
 
filter {
  #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
  if [message] =~ "\tat" {
    grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
    }
  }
 
}
 
output {
   
  stdout {
    codec => rubydebug
  }
 
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}
2

There are many explanations of this in this forum. Here for example. See also here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.