# Error Indexing Logs generated by APM

**URL:** <https://discuss.elastic.co/t/error-indexing-logs-generated-by-apm/318135>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [November 3, 2022, 7:18pm UTC](https://discuss.elastic.co/t/error-indexing-logs-generated-by-apm/318135 "2022-11-03T19:18:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [November 3, 2022, 7:18pm UTC](https://discuss.elastic.co/t/error-indexing-logs-generated-by-apm/318135/1 "2022-11-03T19:18:09Z")

</div>

I'm receiving the following error, whether I'm monitoring this application with a filebeat daemonset deployed to Kubernetes using autodiscovery or with Elastic Agent and the Kubernetes integration:

```auto
Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.November, 3, 13, 10, 44, 213072493, time.Location(\"\")), Meta: {...event data trimmed ...}, Private:(*input_logfile.updateOp)(0xc0052895f0), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:mapstr.M(nil)}} (status=400): {\"type\":\"illegal_argument_exception\",\"reason\":\"mapper [scope.server] cannot be changed from type [keyword] to [long]\"}, dropping event!

```

The following is the event, cleaned up and prettified in JSON format. While there is no actual `scope.server` object, there is a `scope.headers.server` object, but that's an array.

These logs are being generated by APM, and there is no additional processing happening to them, other than being converted from the NDJSON object. I assume that a `scope.server` field is being injected into the event somewhere, but I have no idea where.

```json
{
    "agent":
    {
        "ephemeral_id": "7a886739-dd57-4022-9b19-c31c09dcc652",
        "id": "cb047285-c25c-404d-afc8-d7eea65b906d",
        "name": "my-elastic-agent-hvphf",
        "type": "filebeat",
        "version": "8.5.0"
    },
    "cloud":
    {
        ...
    },
    "container":
    {
        ...
    },
    "data_stream":
    {
        "dataset": "kubernetes.container_logs",
        "namespace": "default",
        "type": "logs"
    },
    "ecs":
    {
        "version": "1.6.0"
    },
    "elastic_agent":
    {
        "id": "cb047285-c25c-404d-afc8-d7eea65b906d",
        "snapshot": false,
        "version": "8.5.0"
    },
    "event":
    {
        "dataset": "kubernetes.container_logs"
    },
    "host":
    {
        ...
    },
    "input":
    {
        "type": "filestream"
    },
    "kubernetes":
    {
        ...
    },
    "log":
    {
        "file":
        {
            "path": "/var/log/containers/my-app-54765bd557-lsghd_my-app_my-app-cb8c91bbe89a0f5b2a20d6401ae97f38ede923ddc41dc64e7468b348f3ed330e.log"
        },
        "flags":
        [
            "multiline"
        ],
        "logger": "elasticapm.transport.http",
        "offset": 9497849
    },
    "log.level": "debug",
    "message": "Sent request, url=https://apm.example.com:8200/intake/v2/events size=1.23kb status=202",
    "scope":
    {
        "app": "\\u003cfastapi.applications.FastAPI object at 0x7feafd9b1e80\\u003e",
        "asgi":
        {
            "spec_version": "2.1",
            "version": "3.0"
        },
        "client":
        [
            "127.0.0.6",
            60693
        ],
        "endpoint": "\\u003cfunction health_check at 0x7feafc372a60\\u003e",
        "fastapi_astack": "\\u003ccontextlib.AsyncExitStack object at 0x7feafc0682b0\\u003e",
        "headers":
        [
            [
                "b'host'",
                "b'10.1.2.3:80'"
            ],
            [
                "b'user-agent'",
                "b'kube-probe/1.21+'"
            ],
            [
                "b'accept'",
                "b'*/*'"
            ],
            [
                "b'connection'",
                "b'close'"
            ],
            [
                "b'accept-encoding'",
                "b'gzip'"
            ]
        ],
        "http_version": "1.1",
        "method": "GET",
        "path": "/status",
        "query_string": "b''",
        "raw_path": "b'/status'",
        "root_path": "",
        "router": "\\u003cfastapi.routing.APIRouter object at 0x7feafda2b340\\u003e",
        "scheme": "http",
        "server":
        [
            "10.1.2.3",
            80
        ],
        "type": "http"
    },
    "service":
    {
        "name": "my-app"
    },
    "span":
    {
        "id": "6a78464c27819a72"
    },
    "status_code": 200,
    "stream": "stderr",
    "trace":
    {
        "id": "b84a2ece988145a4e1c0991b900da761"
    },
    "transaction":
    {
        "id": "77f19eccbeaedb68"
    }
}

```

# Update

I'm temporarily deploying an Elasticsearch pipeline to remove the `scope.server` field. Now I'm getting the same error on `scope.client`. Temporarily removing that as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2022, 7:18pm UTC](https://discuss.elastic.co/t/error-indexing-logs-generated-by-apm/318135/2 "2022-12-01T19:18:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.