Failed to parse field [request.body] of type [text] in document with id

Elastic Stack Logstash
1

Hi all, i have the following log

{"@timestamp": "2023-09-21T15:04:43.583+03:00","@version": "1","message": "Request log","thread_name": "http-nio-8080-exec-9","level": "INFO","level_value": 20000,"X-REQUEST-ID": "ca17be44-6cd0-42ed-a1c1-d09f5a03017b","request": { "uri": "https://httpstat.us/200", "method": "POST", "body": {"requestCalculate": {"CalculateB2BratingRq": { "scoringPurpose": {"scoringPurposeCode": 23 }, "participants": {"participant": [ {"role": 1,"index": 1,"naturalPerson": { "currentPersonData": {"lastName": "blabla","firstName": "blabla","middleName": "blabla","birthDate": "1975-09-21" }, "primaryID": {"number": "123","idType": "123","serie": "123","issueAuthority": "KZ" }} }] }}},"requestGetRating": {"GetB2BratingRq": { "scoringPurpose": {"scoringPurposeCode": 23 }, "participants": {"participant": [ {"index": 1,"naturalPerson": { "currentPersonData": {"lastName": "blabla","firstName": "blabla","middleName": "blabla","birthDate": "1975-09-21" }, "primaryID": {"number": "123","idType": "123","serie": "123","issueAuthority": "KZ" }} }] }}},"authParams": {} }, "headerList": [{"name": "Accept","value": "application/json"},{"name": "Content-Type","value": "application/json"},{"name": "Content-Length","value": "862"},{"name": "Host","value": "httpstat.us"},{"name": "Connection","value": "Keep-Alive"},{"name": "User-Agent","value": "Apache-HttpClient/4.5.1 (Java/11.0.17)"},{"name": "Cookie","value": "ARRAffinity=81c6b43bcb7aea592e620086200b3ab40b78857d08aa07e29c330415afa10cf8; ARRAffinitySameSite=81c6b43bcb7aea592e620086200b3ab40b78857d08aa07e29c330415afa10cf8"},{"name": "Accept-Encoding","value": "gzip,deflate"} ]} }

And when i parse this i have this error
"reason"=>"failed to parse field [request.body] of type [text] in document with id '2D-ut4oBoKajaVQyOW2l'
I use simple json output
How i can fix this?

2

Most likely the request body is text in Kibana, and you are sending JSON. You have to delete or reindex index, dataview pattern and resend data again

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.