Dynamic JSON -- Can't get text on a START_OBJECT

Elastic Stack Logstash
1

I know the error means it is expecting a string but gets an object, but I have no idea why only this field breaks. It looks and behaves like every other field yet consistently errors out.

Here is the relevant template I am using:

{
  "template" : "logstash-*",
  "version" : 60001,
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "dynamic_json" : {
          "path_match" : "*ID",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "ignore_above": 256 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date"},
        "@version": { "type": "keyword"},
        "geoip"  : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        }
      }
    }
  }
}

Here is a sample JSON input:

{"attendee":[{"userID":["12345"],"fullName":["Doe, John"],"role":["MODERATOR"],"isPresenter":["false"],"isListeningOnly":["false"],"hasJoinedVoice":["true"],"hasVideo":["false"],"clientType":["FLASH"],"os":[{}],"browser":[{}],"browser_family":[{}],"join_time":[{}],"ip":[{}],"in_quality_percentage":["99"],"in_mos":["4.492027"],"write_codec":["SPEEX"],"join_count":["1"],"conn_type":["RTMP"],"chat":["0"],"rtt":["0"],"min_rtt":["0"],"max_rtt":["0"]}]}

... and here is the error:

[2019-01-24T18:10:41,110][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2019.01.24", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x58067416], :response=>{"index"=>{"_index"=>"logstash-2019.01.24", "_type"=>"doc", "_id"=>"qR4OgWgBgeY3q0r1jc0J", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [meetings.meeting.attendees.attendee.conn_type]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:461"}}}}}

2

Maybe better to ask in the Elasticsearch forum? I figured since it was a JSON filter this place would have a better chance.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.