Can't get text on a START_OBJECT

(Aleksei) #1

I have many errors in my logstash logs:

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [datetime]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:688"}}

Also my mapping:

"datetime" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256

How to fix this? Change type? I don't use this field...

(Magnus Bäck) #2

Why keep it around if you don't use it? It looks like the field is mapped as a text field but the datetime field of an event you're trying to send to ES actually contains an object.

(Aleksei) #3

ELK in the implementation phase...There are many many fields, mess in the logs)
Is it easier to delete this field in the logstash filter?

(Magnus Bäck) #4

Is it easier to delete this field in the logstash filter?

That's what I'd do if the field isn't worth keeping.

(Aleksei) #5

Yes, it help me.

Also I have:

Error parsing json {:source=>"message", :raw=>"{"SOURCE":"s_src","PROGRAM":"task-run","MSGID":"5695103","MSEC":006,"MESSAGE":"init: task-run (consumer-22) main process ended, respawning","ISODATE":"2017-03-29T10:50:52+03:00","HOST_FROM":"test.local","HOST":"test.local","FILE_NAME":"/dev/kmsg"}\n", :exception=>#<LogStash::Json::ParserError: Invalid numeric value: Leading zeroes not allowed
at [Source: [B@3966c3c4; line: 1, column: 73]>}

I understand it because of MSEC. But removing of field don't help

(Magnus Bäck) #6

If you actually managed to remove the MSEC field I'd expect that the error message changes at least a bit.

(Aleksei) #7

I tried:
mutate {
remove_field => [ "datetime", "MSEC" ]
And I get absolutely the same errors.

(Magnus Bäck) #8

Um, wait. The error occurs when the JSON string is being parsed, and at that point there is no MSEC field. The JSON spec doesn't allow octal numbers so Logstash is correctly rejecting the bad input.

(Aleksei) #9

And how it can be bypassed? What can you advise?

(Magnus Bäck) #10

Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

(Aleksei) #11

Thank you,

if "MSEC" in [message] {
mutate {
        gsub => [ "message", ",\"MSEC\":.{3},", ","]

It work for me.

(system) #12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.