Error type mapper


(Anonymous) #1

Good afternoon. I can not figure out the problem.
Input json

{ "@message":"execution error [неверный синтаксис для типа timestamp with time zone: \"Invalid date\"]", "timestamp":"2018-01-26T07:23:15+00:00", "@fields":{ "error":{}, "q":{ "name":"store-calendar-event", "text":"INSERT INTO \"service_calendar\".\"events\" (\n \"calendar_event_type\",\n \"start_date\",\n \"end_date\",\n \"start_show\",\n \"end_show\",\n \"case_guid\",\n \"entity_guid\",\n \"case_type\",\n \"entity_code\",\n \"entity_type\",\n \"contractor\",\n \"department\",\n \"employee\"\n ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13);", "values":[ "planned_inspection", "Invalid date", "Invalid date", "2018-01-16T10:59:23.334Z", null, "46ad517a-04d6-43bf-a3e2-81258dae1c5d", "a378e73b-97f9-4e17-9f46-f65dddeffbce", "case_object", "inspection", "business_entity", "ceb2e072-9759-47ca-8614-afdd20ec5e77", 16, [ 465 ] ] }, "level":"error", "label":"calendar@0.2.4.events-service:" } }

in log logstash see:

[2018-01-26T07:17:46,525][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mosreg-calendar-2018.01.26", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x5d360d74>], :response=>{"index"=>{"_index"=>"mosreg-calendar-2018.01.26", "_type"=>"doc", "_id"=>"ovVUMWEBap9a0FyiV22V", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [@fields.q.values] of different type, current_type [date], merged_type [text]"}}}}

how solve problem?


(Magnus Bäck) #2

It looks like @fields.q.values has been mapped as a date field but the document Logstash is sending contains a values arrays with non-dates.


(Anonymous) #3

i do solved:
filter {
ruby { code => 'i = 0
event.get("[@fields][q][values]").each {|val|
event.set("[@fields][q][value][#{i}]", val.to_s)
i += 1}'
remove_field => ["[@fields][q][values]"]
}
}


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.