# Elastics search error triggered by logstash Grok Pattern

**URL:** <https://discuss.elastic.co/t/elastics-search-error-triggered-by-logstash-grok-pattern/137859>\
**Category:** Logstash\
**Created:** [June 28, 2018, 9:17pm UTC](https://discuss.elastic.co/t/elastics-search-error-triggered-by-logstash-grok-pattern/137859 "2018-06-28T21:17:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![warrior](https://avatars.discourse-cdn.com/v4/letter/w/2bfe46/32.png) [@warrior](https://discuss.elastic.co/u/warrior)\
**Post date:** [June 28, 2018, 9:17pm UTC](https://discuss.elastic.co/t/elastics-search-error-triggered-by-logstash-grok-pattern/137859/1 "2018-06-28T21:17:25Z")

</div>

@dadoonet @magnusbaeck  
Magnus Bäck

My Elasticsearch is dying with this groke pattern and the following is the error from es.

Please let me know whether these groke patterns can be optimized for optimal performance of logtstash

**Es error:**

Object mapping for [configurationItems.configuration.state] tried to parse field [state] as object, but found a concrete value

and please find groke pattern over here:

[[https://pastebin.com/raw/sHmff4Aq](https://pastebin.com/raw/sHmff4Aq)]

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 29, 2018, 6:48am UTC](https://discuss.elastic.co/t/elastics-search-error-triggered-by-logstash-grok-pattern/137859/2 "2018-06-29T06:48:56Z")

</div>

Please do not ping people not already involved in the issue. This forum is manned by volunteers, so please be patient and wait for someone to respond.

This has nothing to do with grok, but rather the structure of your document. Elasticsearch requires that every field has a single mapping, and you have a field name `state` that in different parts of the document contains a concrete value and in others an object. This is not allowed, so you need to change the structure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2018, 6:49am UTC](https://discuss.elastic.co/t/elastics-search-error-triggered-by-logstash-grok-pattern/137859/3 "2018-07-27T06:49:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.