Could not index event to Elasticsearch error

Elastic Stack Logstash
1

I'm not getting any logs stored, and when checking the docker logs i have this repeated over and over

[2019-02-15T18:07:03,579][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2019.02.15", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x3054cfc0>], :response=>{"index"=>{"_index"=>"logstash-2019.02.15", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: No field type matched on [float], possible values are [object, string, long, double, boolean, date, binary]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"No field type matched on [float], possible values are [object, string, long, double, boolean, date, binary]"}}}}}

2

In elasticsearch, try

curl -X GET "localhost:9200/_mapping"

and see what the mapping for the logstash-* indexes looks like

3

I checked and it gave me the last index in early january (I'm updating the stack as it no longer worked). and I see a bunch of float values, but the index template i put into elasticsearch and elastalert has no float values.

{
  "template": "logstash-*",
  "order": 1, 
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },

  "mappings": {
    "_default_": {
      "properties": {
        "time": {
          "type": "date",
          "format": "basic_time_no_millis"
        },
        "before": {
          "type": "date",
          "format": "strict_date_time"
        },
        "after": {
          "type": "date",
          "format": "strict_date_time"
        },
        "logsource": {
          "type": "ip"
        }
      }
    } 
  }
}

and the last index (as much as it can be pasted. char limit)

{"logstash-2019.01.05":{"mappings":{"doc":{"_all":`{"enabled":true,"norms":false},"dynamic_templates":[{"message_field":{"path_match":"message","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string"}}},{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string","doc_values":true}},"index":"analyzed","omit_norms":true,"type":"string"}}},{"double_fields":{"match":"*","match_mapping_type":"double","mapping":{"doc_values":true,"type":"double"}}},{"long_fields":{"match":"*","match_mapping_type":"long","mapping":{"doc_values":true,"type":"long"}}},{"date_fields":{"match":"*","match_mapping_type":"date","mapping":{"doc_values":true,"type":"date"}}}],"properties":{"@timestamp":{"type":"date"},"@version":{"type":"keyword"},"Date_Conn_Time":{"type":"long"},"Date_Parse_Time":{"type":"long"},"Date_Query_Time":{"type":"long"},"News_Conn_Time":{"type":"long"},"News_Query_Time":{"type":"long"},"app_name":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"cpu_usage":{"type":"double"},"data_mem":{"type":"long"},"facility":{"type":"long"},"facility_label":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"file":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"free_gpu_mem":{"type":"long"},"geoip":{"dynamic":"true","properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":{"type":"geo_point"},"longitude":{"type":"float"}}},"health_check":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"host":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"level":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"line_num":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"logsource":{"type":"ip"},"memory_used":{"type":"long"},"message":{"type":"text","norms":false},"pid":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"priority":{"type":"long"},"program":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"pss_mem":{"type":"long"},"pulse_git_events":{"type":"long"},"pulse_news_count":{"type":"long"},"pulse_trending_count":{"type":"long"},"repeat_count":{"type":"long"},"rss_mem":{"type":"long"},"severity":{"type":"long"},"severity_label":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"shared_mem":{"type":"long"},"site":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"tags":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"test_unique":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"text_mem":{"type":"long"},"time":{"type":"date","format":"basic_time_no_millis"},"total_gpu_mem":{"type":"long"},"used_gpu_mem":{"type":"long"},"uss_mem":{"type":"long"},"vms_mem":{"type":"long"},"weekday":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}}}},"syslog":{"_all":{"enabled":true,"norms":false},"dynamic_templates":[{"message_field":{"path_match":"message","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string"}}},{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string","doc_values":true}},"index":"analyzed","omit_norms":true,"type":"string"}}},{"double_fields":{"match":"*","match_mapping_type":"double","mapping":{"doc_values":true,"type":"double"}}},{"long_fields":{"match":"*","match_mapping_type":"long","mapping":{"doc_values":true,"type":"long"}}},{"date_fields":{"match":"*","match_mapping_type":"date","mapping":{"doc_values":true,"type":"date"}}}],"properties":{"@timestamp":{"type":"date"},"@version":{"type":"keyword"},"after":{"type":"date","format":"strict_date_time"},"before":{"type":"date","format":"strict_date_time"},"geoip":{"dynamic":"true","properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":{"type":"geo_point"},"longitude":{"type":"float"}}},"logsource":{"type":"ip"},"time":{"type":"date","format":"basic_time_no_millis"}}},"logs":{"_all":{"enabled":true,"norms":false},"dynamic_templates":[{"message_field":{"path_match":"message","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string"}}},{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fielddata":{"format":"disabled"},"fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string","doc_values":true}},"index":"analyzed","omit_norms":true,"type":"string"}}},{"double_fields":{"match":"*","match_mapping_type":"double","mapping":{"doc_values":true,"type":"double"}}},{"long_fields":{"match":"*","match_mapping_type":"long","mapping":{"doc_values":true,"type":"long"}}},{"date_fields":{"match":"*","match_mapping_type":"date","mapping":{"doc_values":true,"type":"date"}}}],"properties":{"@timestamp":{"type":"date"},"@version":{"type":"keyword"},"Date_Conn_Time":{"type":"long"},"Date_Parse_Time":{"type":"long"},"Date_Query_Time":{"type":"long"},"News_Conn_Time":{"type":"long"},"News_Query_Time":{"type":"long"},"app_name":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"cpu_usage":{"type":"double"},"data_mem":{"type":"long"},"facility":{"type":"long"},"facility_label":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"file":{"type":"text","norms":false,"fields":{"raw":{"type":"keyword","ignore_above":256}}},"free_gpu_mem":{"type":"long"},"geoip":{"dynamic":"true","properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":
4

I tried changing the float value in the config file but that gave more errors

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.