Can't get text on a START_OBJECT

Elastic Stack Logstash
1

Hello,
I have many errors in my logstash logs:

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [datetime]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:688"}}

Also my mapping:

"datetime" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},

How to fix this? Change type? I don't use this field...

2

Why keep it around if you don't use it? It looks like the field is mapped as a text field but the datetime field of an event you're trying to send to ES actually contains an object.

3

ELK in the implementation phase...There are many many fields, mess in the logs)
Is it easier to delete this field in the logstash filter?

4

Is it easier to delete this field in the logstash filter?

That's what I'd do if the field isn't worth keeping.

5

Yes, it help me.

Also I have:

Error parsing json {:source=>"message", :raw=>"{"SOURCE":"s_src","PROGRAM":"task-run","MSGID":"5695103","MSEC":006,"MESSAGE":"init: task-run (consumer-22) main process ended, respawning","ISODATE":"2017-03-29T10:50:52+03:00","HOST_FROM":"test.local","HOST":"test.local","FILE_NAME":"/dev/kmsg"}\n", :exception=>#<LogStash::Json::ParserError: Invalid numeric value: Leading zeroes not allowed
at [Source: [B@3966c3c4; line: 1, column: 73]>}

I understand it because of MSEC. But removing of field don't help

6

If you actually managed to remove the MSEC field I'd expect that the error message changes at least a bit.

7

I tried:
mutate {
remove_field => [ "datetime", "MSEC" ]
}
And I get absolutely the same errors.

1 Like
8

Um, wait. The error occurs when the JSON string is being parsed, and at that point there is no MSEC field. The JSON spec doesn't allow octal numbers so Logstash is correctly rejecting the bad input.

9

And how it can be bypassed? What can you advise?

10

Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

11

Thank you,

if "MSEC" in [message] {
mutate {
        gsub => [ "message", ",\"MSEC\":.{3},", ","]
}
}

It work for me.

1 Like
12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.