# Dealing with "malformed" attributes

**URL:** <https://discuss.elastic.co/t/dealing-with-malformed-attributes/185133>\
**Category:** Elasticsearch\
**Created:** [June 11, 2019, 9:04am UTC](https://discuss.elastic.co/t/dealing-with-malformed-attributes/185133 "2019-06-11T09:04:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dorrringel](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@dorrringel](https://discuss.elastic.co/u/dorrringel)\
**Post date:** [June 11, 2019, 9:04am UTC](https://discuss.elastic.co/t/dealing-with-malformed-attributes/185133/1 "2019-06-11T09:04:01Z")

</div>

I'm using Elasticsearch to process user logs and clickstream data.

Each such log contains several primitive attributes (version, environment, userID, etc.), but the heart of it is a JSON "data" object, which holds all the relevant information regarding the desired log.

There are various types of logs, and their "data" object differs greatly from one another.

I'm looking for a solution that will allow me to index these documents with a different structure.

Potential solutions

1. I know about the ignore\_malformed parameter, that will allow me to suppress the error, but as I want the "data" object to be indexed, that's not a solution.

2. I can Strinfigy the entire "date" object, which will also suppress the error, but then searching through the JSON will be inferior.

Would appreciate additional insights.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2019, 9:08am UTC](https://discuss.elastic.co/t/dealing-with-malformed-attributes/185133/2 "2019-07-09T09:08:53Z")

</div>

Closed on July 9, 2019, 9:08am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.