Dissect failed finding my field in event

Elastic Stack Logstash
1

Hi experts!!

I have an index mapping like this :

{
  "talend-esb-dev-2022.06" : {
    "mappings" : {
      "properties" : {
        "customInfo" : {
          "properties" : {
            "camel" : {
              "properties" : {
                "contextId" : {
                  "type" : "text"
                }
              }
            }
          }
        }
      }
    }
  }
}

In Logtash, I try to dissect the contextId this way :

 dissect { 
  mapping => { '[customInfo][camel][contextID]' => "%{projet}.%{domaine}_%{appli_source}_%{appli_cible}_%{reste_a_jeter}" } 
 }

However, when I launch the pipeline, I obtain this error message :

Dissector mapping, field not found in event {"field"=>"[customInfo][camel][contextId]", "event"=>{"org.ops4j.pax.logging.appender.name"=>"DecanterLogCollectorAppender", "loggerClass"=>"org.ops4j.pax.logging.slf4j.Slf4jLogger", "input"=>{"type"=>"log"}, "serverTimestamp"=>"2022-06-29T14:54:12.371+02", "felix.fileinstall.filename"=>"file:/opt/TalendRuntime-8.0.1/runtime/etc/org.apache.karaf.decanter.collector.log.cfg", "loc.file"=>"JmxManagementStrategy.java", "customInfo"=>{"bundle.version"=>"3.11.1", "bundle.name"=>"org.apache.camel.camel-management", "camel.contextId"=>"interfaces.cmd001_gnx_ids_0_1.CMD001_GNX_IDS", "bundle.id"=>"127"}, "@timestamp"=>2022-06-29T20:44:53.758Z, "error"=>{"message"=>"@timestamp not overwritten (parse error on 2022-06-29T12:54:12,371Z)", "type"=>"json"}, "type"=>"log", "loc.line"=>"124", "severity"=>"INFO", "ignored.categories"=>"org.apache.karaf.decanter.appender.*", "eventUUID"=>"1a7be7a6-61b4-4943-8e01-2f1250763afc", "eventType"=>"LOGEvent", "name"=>"log", "agentId"=>"agent1", "loc.method"=>"doInit", "event.topics"=>"decanter/collect/log/org_apache_camel_management_JmxManagementStrategy", "category"=>"system", "host"=>{"name"=>"ND127"}, "component.id"=>25, "logMessage"=>"JMX is enabled", "agent"=>{"ephemeral_id"=>"4f7c4c76-cfd9-421c-abc3-9ffab38637ac", "type"=>"filebeat", "name"=>"ND127", "version"=>"7.10.0", "id"=>"7a4b2a17-b3a7-4f0e-9af3-8da825964d13", "hostname"=>"ND127"}, "karafName"=>"trun", "timestamp"=>1656507252371, "tags"=>["beats_input_raw_event"], "hostName"=>"deb10tredev", "loc.class"=>"org.apache.camel.management.JmxManagementStrategy", "hostAddress"=>"127.0.1.1", "component.name"=>"org.apache.karaf.decanter.collector.log", "threadName"=>"Blueprint Event Dispatcher: 1", "log"=>{"file"=>{"path"=>"c:\dsrestau\data\em.log"}, "offset"=>0}, "loggerName"=>"org.apache.camel.management.JmxManagementStrategy", "service.pid"=>"org.apache.karaf.decanter.collector.log", "dt_date_log"=>2022-06-29T12:54:12.371Z, "ecs"=>{"version"=>"1.6.0"}, "logTimestamp"=>"2022-06-29T14:54:12.371+02", "@version"=>"1"}

Could you please help me??

Best regards,

2

No such field. Try mapping => { '[customInfo][camel.contextID]' =>

1 Like
3

Thanks it worked!!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.