I am trying to ingest json data into Elasticsearch vai http_poller and facing following error.
elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"cloudflare", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x374d9c8a>], :response=>{"index"=>{"_index"=>"cloudflare", "_type"=>"_doc", "_id"=>"Q7abqnYB5t7OruSGmufO", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [result.timeseries.requests.ssl_protocol.TLSv1] tried to parse field [TLSv1] as object, but found a concrete value"}}}}
following is my json output. Also, I tried to remove TLSv1 field with mutate filter plugin but no luck.
"requests" => {
"country" => {
"NZ" => 55423,
"BR" => 485308,
"RO" => 16659,
"BE" => 26518,
"PT" => 20373,
"IQ" => 31281,
"AZ" => 2468,
"FR" => 289754,
"RU" => 1008225,
"EC" => 712,
"GR" => 5419,
"PL" => 442467,
"PE" => 2787,
"T1" => 68560,
"HN" => 1228,
"DO" => 3468,
"AL" => 2459,
"KR" => 29086,
"DE" => 554766,
"EE" => 5165,
"AR" => 12527,
"HU" => 7377,
"US" => 6157511,
"NG" => 612579,
"CL" => 2819,
"NL" => 300650,
"KH" => 12538,
"FI" => 24825,
"MD" => 1863,
"PR" => 1729,
"NP" => 93465,
"TW" => 41790,
"SE" => 60920,
"UZ" => 12306,
"TN" => 4538,
"TR" => 35554,
"CN" => 116307,
"ID" => 61687,
"KG" => 113,
"KW" => 417314,
"AU" => 1075888,
"CH" => 27368,
"UNKNOWN" => 309759
},
"all" => 359389438,
"cached" => 141236357,
"ip_class" => {
"badHost" => 181628,
"noRecord" => 354205944,
"tor" => 66768,
"whitelist" => 11544,
"scan" => 62,
"searchEngine" => 2458775,
"monitoringService" => 102299,
"unknown" => 2362418
},
"ssl_protocol" => {
"none" => 2169427,
"TLSv1.2" => 66591283,
"TLSv1.1" => 38,
"TLSv1.3" => 290425581,
"TLSv1" => 203109
},
"content_type" => {
"gif" => 661470,
"octet-stream" => 2143673,
"webp" => 11242,
"javascript" => 13642646,
"css" => 10824672,
"json" => 90472115,
"empty" => 91781413,
"svg" => 28279,
"png" => 86786833,
"xml" => 984799,
"jpeg" => 480033,
"html" => 44372134,
"other" => 11049541,
"plain" => 6150588
},
"http_status" => {
"408" => 5699,
"520" => 1385,
"302" => 23490038,
"403" => 9750515,
"401" => 3330,
"522" => 3682239,
"307" => 6998,
"409" => 80,
"411" => 30,
"500" => 222992,
"419" => 6466,
"502" => 79250,
"525" => 36436,
"413" => 1,
"301" => 2828475,
"206" => 26172,
"400" => 135183,
"499" => 1975610,
"416" => 19,
"404" => 7021358,
"503" => 7199,
"429" => 526347,
"405" => 287624,
"504" => 2518,
"431" => 21,
},
"ssl" => {
"unencrypted" => 2169427,
"encrypted" => 357220011
},
"uncached" => 218153081
},
"threats" => {
"country" => {
"VN" => 2389,
"SK" => 81,
"LB" => 27,
"BD" => 2840,
"UY" => 40,
"PK" => 11160,
"MA" => 2002,
"SG" => 13682,
"OM" => 5323,
"BY" => 90,
"CZ" => 662,
"LK" => 209,
"ES" => 345,
"GE" => 493,
"EG" => 147,
"GT" => 3,
"SV" => 3,
"XX" => 1559,
"GB" => 14573,
"BG" => 914,
"CA" => 2026,
"FR" => 11340,
"RU" => 874066,
"EC" => 26,
"GR" => 443,
"PL" => 14943,
"PE" => 33,
"T1" => 47875,
"HN" => 22,
"DO" => 32,
"AL" => 41,
"KR" => 401,
"DE" => 64257,
"EE" => 68,
"AR" => 366,
"HU" => 74,
"US" => 263341,
"NG" => 29606,
"CL" => 29,
"NL" => 44950,
"KH" => 131,
"FI" => 658,
"MD" => 45,
"TW" => 4046,
"NP" => 1207,
"SE" => 7225,
"UZ" => 2310,
"TN" => 39,
"TR" => 1282,
"CN" => 53629,
"ID" => 4969,
"KG" => 4,
"KW" => 10806,
"AU" => 7579,
"CH" => 1550,
"SY" => 7,
"TH" => 136750,
"MX" => 948,
"KE" => 1656,
"UA" => 107028,
"BA" => 14,
"CY" => 321,
"ZA" => 2905,
"LV" => 334,
"IT" => 13472,
"AT" => 119,
"NO" => 12240,
"HK" => 797,
"QA" => 9280,
"SA" => 13628,
"DZ" => 35,
"UNKNOWN" => 16598
},
"all" => 10175767,
"type" => {
"bic.ban.unknown" => 166683,
"macro.chl.captchaFail" => 4
}
},
"since" => "2020-07-11T00:00:00Z",
"uniques" => {
"all" => 6783431
},
"until" => "2020-11-11T00:00:00Z",
"bandwidth" => {
"country" => {
"VN" => 360248464,
"XX" => 1262221735,
"GB" => 4593101267,
"BG" => 94118398,
"CA" => 3776876999,
"JP" => 5174377694,
"AE" => 6497453451,
"IL" => 220997704,
"KZ" => 113939412,
"IE" => 3031523275,
"MY" => 1114503959,
"SI" => 35239909,
"IN" => 2090007266025,
"PA" => 12394174,
"PH" => 621604077,
"DK" => 329225966,
"GH" => 156497712,
"VE" => 47709106,
"BO" => 4973668,
"CO" => 110869140,
"LT" => 57577035,
"MM" => 131061224,
"HR" => 29755829,
"PY" => 2595026,
"IR" => 139407216,
"AM" => 7828388,
"RS" => 47018912,
"CR" => 14905148,
"JO" => 35308920,
"NZ" => 434191755,
"BR" => 2711311791,
"RO" => 183781422,
"BE" => 253719326,
"PT" => 156782935,
"IQ" => 307337817,
"AZ" => 31542452,
"FR" => 2534205916,
"RU" => 7589524541,
"EC" => 8598738,
"GR" => 76798562,
"PL" => 597810808,
"PE" => 34540505,
"T1" => 962832500,
"HN" => 13284602,
"DO" => 33326734,
"AL" => 31142027,
"KR" => 365378227,
"DE" => 4691086283,
"EE" => 78543509,
"AR" => 162277124,
"HU" => 76131766,
"US" => 49087311515,
"QA" => 1858454122,
"SA" => 4406966175,
"DZ" => 44566253,
"UNKNOWN" => 2774012319
},
"all" => 2262958226482,
"cached" => 1705859775268,
"ssl_protocol" => {
"none" => 2169427,
"TLSv1.2" => 66591283,
"TLSv1.1" => 38,
"TLSv1.3" => 290425581,
"TLSv1" => 203109
},
"content_type" => {
"gif" => 25208247170,
"octet-stream" => 62493338242,
"webp" => 365261274,
"javascript" => 660593478441,
"css" => 139228574114,
"json" => 221924585418,
"empty" => 96073712296,
"svg" => 61203615,
"png" => 486605131558,
"xml" => 980474334,
"jpeg" => 13065115173,
"html" => 230919405521,
"other" => 293606779897,
"plain" => 31832919429
},
"ssl" => {
"unencrypted" => 1531023168,
"encrypted" => 2261427203314
},
"uncached" => 557098451214
}
}
},