Could not index event to Elasticsearch Errror

Elastic Stack Elasticsearch
1

Hi,

Please, help me with error

[2020-04-25T01:23:57,058][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"wl_audit-2020.04.25", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x75cf378], :response=>{"index"=>{"_index"=>"wl_audit-2020.04.25", "_type"=>"doc", "_id"=>"QlyTr3EBe85au3CB40Vy", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [log] tried to parse field [log] as object, but found a concrete value"}}}}

2

It seems you have a mapping conflict. The mapping expects the logfield to be an object, but in the document causing the error it instead is a string or a number, which is not allowed.

3

Hi, thanks by the answer, but can you explain how can i solve it?

4

You need to change you event before you index it. As it looks like you are using Logstash you should do it there.

5

@Christian_Dahlqvist, again thanks,
I corrected it as follows, the log field was in lowercase, I changed it to uppercase, I did the restart and it worked, thanks by the fast answer

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.