Can't get text on a START_OBJECT at 1:708

Elastic Stack Beats
1

I am trying to configure SpringBoot <> FileBeat <> LogStash <> ElasticSearch <> Kibana.

But I am getting error at LogStash, here is my code snippets:

filebeat.yml:

filebeat:
  inputs:
    - type: log
      paths:
        - /Users/Smit/Downloads/chrome/observability/spring_app_log_file.log
      
output:
  logstash:
    hosts: ["localhost:5044"]

logstash.config:

input {
  beats {
        port => "5044"
    }
}
 
filter {
  #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
  if [message] =~ "\tat" {
    grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
    }
  }
 
}
 
output {
   
  stdout {
    codec => rubydebug
  }
 
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

Error Related in info:
Log:

{
      "@version" => "1",
           "ecs" => {
        "version" => "1.5.0"
    },
         "agent" => {
            "hostname" => "Smits-MacBook-Pro.local",
                "type" => "filebeat",
        "ephemeral_id" => "76f5b858-bc2d-4f13-bdb1-98f4cad7ce28",
             "version" => "7.8.0",
                  "id" => "864be1a9-e233-4d41-8624-cf94e916a0b7",
                "name" => "Smits-MacBook-Pro.local"
    },
    "@timestamp" => 2020-06-27T17:30:53.807Z,
          "tags" => [
        [0] "beats_input_codec_plain_applied"
    ],
           "log" => {
        "offset" => 8939,
          "file" => {
            "path" => "/Users/Smit/Downloads/chrome/observability/spring_app_log_file.log"
        }
    },
         "input" => {
        "type" => "log"
    },
       "message" => "2020-06-28 01:30:50.017  INFO 41266 --- [http-nio-8080-exec-6] c.e.observability.aop.LoggingAdvice      : Method Invoked getGreeting in class class com.example.observability.service.GreetingService with args [godknows]",
          "host" => {
        "name" => "Smits-MacBook-Pro.local"
    }
}

Error:

[2020-06-28T01:30:54,983][WARN ][logstash.outputs.elasticsearch][main][e355ceb00d3e298d5bee1962185a3aac2c9bdd4e945037e76fdcce0f773027e6] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x2103d045>], :response=>{"index"=>{"_index"=>"logstash-2020.06.27-000001", "_type"=>"_doc", "_id"=>"znzV9nIBBsHFC7FTBLmF", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'znzV9nIBBsHFC7FTBLmF'. Preview of field's value: '{name=Smits-MacBook-Pro.local}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:708"}}}}}
2

Do you have an error log on elasticsearch side ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.