ES stack 6.3.0 stopped working =>Can't get text on a START_OBJECT

Elastic Stack Logstash
1

After upgrading ES stack from 6.2.4 => 6.3.0 Logstash isn't producing any data.
In LS log I've found:

[2018-06-26T13:44:05,968][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"SIKSKL2017-05-19T05:46:36.000Z1140994898", :_index=>"transakcije_kv", :_type=>"log_transakcije", :_routing=>nil}, #<LogStash::Event:0x40f46392>], :response=>{"index"=>{"_index"=>"transakcije_kv", "_type"=>"log_transakcije", "_id"=>"SIKSKL2017-05-19T05:46:36.000Z1140994898", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:980"}}}}}

But host is produced by FB.
Can anyone advice me, how to fix this?

2

I answered the same question yesterday, so search for that or just google the error message in general. You're not the first person to hit this.

3

Found a similarity using Google on Stack Owerflow.
And got it fixed.

As I can see the sintacs of FB output has changed. As I did nothing with host field.
So an on the fly upgrade is not possible any more.

And yes I did a search on discuss, but I didn't found a topic with host field involved.
So sorry for the duplication of topics and questions.

4

So now all of us who uses Beats, have to reindex all our indexes.
This is a enormous tasks.

This is the description of it:

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.