Failed to parse [host] error

Elastic Stack Logstash
1

Hi,
I am getting the following error when I am launching logstash. I have sending data from winlogbeat.

[2018-12-19T15:59:12,495][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.12.18", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x2070f7ee], :response=>{"index"=>{"_index"=>"logstash-2018.12.18", "_type"=>"doc", "_id"=>"_5QBxmcBSmploCAdK_sp", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:775"}}}}}

Can anyone please help me in resolving the error?

regards,
ruthvik

2

Hi @Ruthvik_Sai,

any chance you have recently upgraded winlogbeat or run different versions of it?

Could be https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-6.3.html#breaking-changes-mapping-conflict

3

Thanks @A_B..
I will check the link and get back

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.