Could not index event to Elasticsearch. - failed to parse [host]

Elastic Stack Logstash
1 
[WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"point2homesiis-2018.09.10", :_type=>"iis", :_routing=>nil}, #<LogStash::Event:0x5c396f0>], :response=>{"index"=>{"_index"=>"point2homesiis-2018.09.10", "_type"=>"iis", "_id"=>"lnJjwmUBiym8oORci_sq", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:493"}}}}}

Hello, I am getting the error above and cant understand why i get it and how to fix it? My .conf file seems to be correct. How can i track down this to find out the source of error and fix it?

2

Please post your config file if you want help with that
you can debug with: --log.level LEVEL

see: https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html

3

Google the error message and you should find several explanations (including a GitHub issue) that explains what's going on.

4

hi , i found on google multiple articles but i am usure where i have to add what

[2018-09-11T02:57:19,852][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"pointiis-2018.09.11", :_type=>"iis", :_routing=>nil}, #<LogStash::Event:0x6f7321ae>], :response=>{"index"=>{"_index"=>"pointiis-2018.09.11", "_type"=>"iis", "_id"=>"2g2ix2UBiym8oORcfkgd", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:142"}}}}

You say in one theard:
Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

Where is that JSON file located? And how to find which json we have to fix?

5

Fixing the bad JSON data would be the best option. If that's impossible a mutate filter with a gsub that removes the leading zeroes should work.

I don't have the context of where I said that but it looks like a completely different problem.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.