Elasticsearch name cannot be empty string error


(Zeeshan Alam) #1

I am sending events from Logstash 5.2.0 to Elasticsearch 5.2.0, but some of the events are rejected by elasticsearch and I am getting the following error:

[2017-02-15T05: 36: 23,
145][WARN][logstash.outputs.elasticsearch]Failedaction.{
	: status=>400,
	: action=>["index",
	{
		: _id=>nil,
		: _index=>"logstash-pr106659-rtp0-uat-metrics-2017.02.13-1",
		: _type=>"logs",
		: _routing=>nil
	},
	#<LogStash: : Event: 0x7934efaf@data={
		"@timestamp"=>2017-02-13T12: 28: 34.266Z,
		"service"=>"linux-metrics",
		"host"=>"myhost.fmr.com",
		"@version"=>"1",
		"location"=>"OMA",
		"attributes"=>{
			"m.rocana.host.fs.mp.fisc.backup.inodes.free"=>327190.0,
			"m.rocana.host.fs.mp.opt.vormetric.DataSecurityExpert.agent.secfs..sec.inodes.perc_in_use"=>12.698364258,			
			"m.rocana.host.fs.mp.fisc.blocks.free"=>5614588.0,
			"m.rocana.host.fs.mp.opt.blocks.in_use"=>586600.0,
			"m.rocana.host.fs.mp.opt.vormetric.DataSecurityExpert.agent.secfs..sec.inodes.total"=>131072.0,
			"m.rocana.host.fs.mp.tmp.blocks.total"=>524288.0,
			"m.rocana.host.fs.mp.apps.blocks.free"=>48657964.0,
			"m.rocana.host.fs.mp.var.blocks.free"=>5264320.0,
			"m.rocana.host.fs.mp.fisc.tmq.blocks.total"=>3997376.0,
			"m.rocana.host.fs.mp.var.log.inodes.perc_in_use"=>0.44021606445,
			"m.rocana.host.fs.mp.opt.vormetric.DataSecurityExpert.agent.secfs..sec.inodes.in_use"=>16644.0,
			"m.rocana.host.fs.mproot.inodes.free"=>739162.0,
			"m.rocana.host.fs.mp.fisc.backup.inodes.in_use"=>490.0,
			"m.rocana.host.fs.mp.fisc.backup.blocks.total"=>5029504.0,
			"m.rocana.host.fs.mp.opt.vormetric.DataSecurityExpert.agent.secfs..sec.inodes.free"=>114428.0,
			"m.rocana.host.fs.mp.var.crash.inodes.in_use"=>11.0,
			"m.rocana.host.fs.mp.tmp.inodes.in_use"=>15.0,
			"m.rocana.host.fs.mp.fisc.middleware.db_mw.inodes.in_use"=>807398.0,
			"m.rocana.host.fs.mp.opt.vormetric.DataSecurityExpert.agent.secfs..sec.blocks.free"=>1307216.0,
			"m.rocana.host.fs.mp.fisc.blocks.in_use"=>132472.0,
			"m.rocana.host.fs.mp.boot.blocks.total"=>245679.0
		},
		"id"=>"3BUARTQFY2PVLGMGTNAM5ZNXYOEK6BWD77YI6YRWA6SL2NE5BH4Q====",
		"source"=>"",
		"body"=>"",
		"version"=>3,
		"event_type_id"=>107,
		"ts"=>1486988914266
	}>],
	: response=>{
		"index"=>{
			"_index"=>"logstash-pr106659-rtp0-uat-metrics-2017.02.13-1",
			"_type"=>"logs",
			"_id"=>"AVpBWCNua7XAD4eRlmho",
			"status"=>400,
			"error"=>{
				"type"=>"mapper_parsing_exception",
				"reason"=>"failed to parse",
				"caused_by"=>{
					"type"=>"illegal_argument_exception",
					"reason"=>"name cannot be empty string"
				}
			}
		}
	}
}

(Mark Walkom) #2

Is there anything in the ES logs at the same time?


(Zeeshan Alam) #3

I think this field is the culprit, it is having double dot secfs..sec


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.