# Error in Parsing logs

**URL:** https://discuss.elastic.co/t/error-in-parsing-logs/160906
**Category:** Elasticsearch
**Created:** [December 14, 2018, 1:05pm UTC](https://discuss.elastic.co/t/error-in-parsing-logs/160906 "2018-12-14T13:05:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![shruti51](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@shruti51](https://discuss.elastic.co/u/shruti51)
#### Post date: [December 14, 2018, 1:05pm UTC](https://discuss.elastic.co/t/error-in-parsing-logs/160906/1 "2018-12-14T13:05:23Z")

</div>

HI,

My logstash configuration is:

> input {  
> file {  
> path =\> "/opt/XXX/\*.txt"  
> start\_position =\> "beginning"  
> add\_field =\> ["log\_type","xyz"]  
> }  
> }
> 
> # The filter part of this file is commented out to indicate that it is
> 
> # optional.
> 
> filter {  
> if [log\_type] == "xyz" {  
> dissect {  
> mapping =\> {  
> message =\> "%{act}|%{yui}|%{dsd}|%{ds}|%{ds}|%{dd}"
> 
> ```
> }
> }
> 
> ```
> 
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["eee"]  
> manage\_template =\> false  
> user =\> QQQ  
> password =\> WER  
> index =\> "ert"  
> }  
> stdout {  
> codec =\> rubydebug  
> }
> 
> }

Earlier ,it was working fine. Now it is throwing the error:  
Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6}

I have used "log\_type" and not "type".It is throwing error now also.  
Please help.

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [December 14, 2018, 4:30pm UTC](https://discuss.elastic.co/t/error-in-parsing-logs/160906/2 "2018-12-14T16:30:50Z")

</div>

Hi @shruti51,

It would be much easier to read your config if you would format your post better. Also, you ask a Logstash question in the Elasticsearch forum...

[add\_field](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-add_field) should be a _hash_, not an _array_. I would start with changing that. And you are not assigning the value to `log_type` as you expect.

Try something like

```
input {
  file {
    path => "/opt/XXX/*.txt"
    start_position => "beginning"
    add_field => {
      "log_type" => "xyz"
    }
  }
}

```

-AB

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 11, 2019, 4:31pm UTC](https://discuss.elastic.co/t/error-in-parsing-logs/160906/3 "2019-01-11T16:31:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.