Exception caught while applying mutate filter {:exception=>"Could not set field 'product' on object 'x' to value 'y'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"}

[mwitsas]

When attempting to rename fields as in the following example:

  mutate {
    rename => {
      "vendor" => "[abc][vendor]"
      "vendor_product" => "[abc][vendor][product]"
      "vendor_product_version" => "[abc][vendor][product][version]"
   }
 }

I get the following error:

[2024-01-24T12:07:47,506][WARN ][logstash.filters.mutate ][test-pipeline][ecb4213a79da96df1d34665b2fe43c7b255995e3af6e5ac336ef36beda368532] Exception caught while applying mutate filter {:exception=>"Could not set field 'product' on object 'abc' to value 'def ghi'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"}

I have seen a couple of other posts around this error suggesting the field [abc][vendor] is a string and not an object at the point the subfield is assigned, but have not been able to figure the solution out.

Any help appreciated!

[leandrojmp (Leandro Pereira)]

@mwitsas

I have seen a couple of other posts around this error suggesting the field [abc][vendor] is a string and not an object at the point the subfield is assigned, but have not been able to figure the solution out.

What you are trying to do is not possible, you need to change the fields names, you can't mix strings and objects in the same field like you are doing.

You need something like this:

mutate {
  rename => {
    "vendor" => "[abc][vendor][vendor_name]"
    "vendor_product" => "[abc][vendor][product_name]"
    "vendor_product_version" => "[abc][vendor][product_version]"
  }
}