Failed to parse field

[Senthil_ak (Senthil kumar)]

Hi admin,
I am getting some strange exception in the logstash all of a sudden. I try to debug but unable to do so. Need your kind help.

[2021-08-11T15:37:35,189][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"dev-ecp-cluster-01-2021.08.11", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x571119f0>], :response=>{"index"=>{"_index"=>"dev-cluster-01-2021.08.11", "_type"=>"_doc", "_id"=>"Zvu4NnsB4pQCkHpaVLyA", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [attr.error] of type [text] in document with id 'Zvu4NnsB4pQCkHpaVLyA'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:863"}}}}}

I tried below but still the error is coming.

if [attr.error] { mutate { rename => { "[attr.error]" => "[attr][error]" } } }

Thanks
Senthil.

[Badger]

"mapper_parsing_exception", "reason"=>"failed to parse field [attr.error] of type [text] in document with id 'Zvu4NnsB4pQCkHpaVLyA'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:863"}}}}}

elasticsearch expects the [attr.error] field (which, unless the name contains a . would be referred to using [attr][error] in logstash) to be text. However, it is finding that the value of that field is an object. In other words, there is an [attr][error][someField]. You could try converting [attr][error]

if [attr][error] { mutate { convert => { "[attr][error" => "string" } } }

[Senthil_ak (Senthil kumar)]

Thanks, i will try that... I tried with

if [attr][error] { mutate { convert => { "[attr][error]" => "string" } } }

but still i am getting error.

[2021-08-11T20:58:32,584][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"dev-ecp-cluster-01-2021.08.12", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x2b63239c>], :response=>{"index"=>{"_index"=>"dev-cluster-01-2021.08.12", "_type"=>"_doc", "_id"=>"Dd7eN3sB7IddBQa8LOaG", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [attr.error] of type [text] in document with id 'Dd7eN3sB7IddBQa8LOaG'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1294"}}}}}
[2021-08-11T20:58:32,587][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"dev-ecp-cluster-01-2021.08.12", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x42717ac4>], :response=>{"index"=>{"_index"=>"dev-cluster-01-2021.08.12", "_type"=>"_doc", "_id"=>"D97eN3sB7IddBQa8LOaG", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [attr.error] of type [text] in document with id 'D97eN3sB7IddBQa8LOaG'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1295"}}}}}

[Badger]

Is it possible that the field name is actually attr.error? Look at a document that does get indexed, and in the Discover pane of kibana, as I recall, you can tell the difference when you expand the event, possibly on the JSON tab.

[Senthil_ak (Senthil kumar)]

I am converting k8s logs to json object, I am having below line in the logstash.

if [message] =~ "\A\{.+\}\z" { json { source => "message" } }

I did commented the line and the error is not occurring also I am able to see the att.error filed in the kibana.