Elasticsearch filter - fields array

Hi,

I've this script... It works fine with one field in elasticsearch filter. But starts giving error with multiple fields. How to pass fields array

elasticsearch {
hosts => ["localhost:3602"]
sort => "eid:desc"
index => "master_idx"
query => "_type:enterprise-item AND my_item_id:%{[my_item_id]}"
fields => [{"eid" => "eid"}, {"pos_item_id" => "pos_item_id"}]
fields => {"eid" => "eid"} " ---- this works --- "
}

Getting error -
[2017-12-12T12:59:49,784][WARN ][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=>"dev_chetan_master", :query=>"_type:enterprise-item AND my_item_id:J25164000001000", :event=>%{host} %{message}, :error=>#<TypeError: can't convert nil into String>}

Got it...

elasticsearch {
hosts => ["localhost:3602"]
sort => "eid:desc"
index => "master_idx"
query => "_type:enterprise-item AND my_item_id:%{[my_item_id]}"
fields => {"pos_item_id" => "pos_item_id"}
fields => {"eid" => "eid"}
}

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.