Elastic Stack Mapping Error

Elastic Stack Elasticsearch
7

If ndc should always be == to ![CDATA[]] then I would just do a conditional statement checking that field and if it doesn't contain that value replace it with some dummy text or leave empty. Or you can even set it as ![CDATA[]] if that is needed.

This doesn't fix the root cause but I am not sure what that is.

Test Conf

input { generator { lines => ['[{"ndc":"![CDATA[]]"},{"ndc":"{}"}]'] count => 1 codec => "json" } }
filter {
  if [ndc] != "![CDATA[]]" {
    mutate {
      update => { "[ndc]" => "![CDATA[]]" }
    }
  }
}
output { stdout { codec => json } }