Failed to parse value [no]

Elastic Stack Elasticsearch
1

I am getting this error after my upgrade to 6.0 GA

[2017-11-16T11:16:50,464][DEBUG][o.e.a.b.TransportShardBulkAction] [logs.web-2017.11.01][0] failed to execute bulk item (index) BulkShardRequest [[logs.web-2017.11.01][0]] containing [index {[...]}]
org.elasticsearch.index.mapper.MapperParsingException: failed to parse
        at org.elasticsearch.index.mapper.DocumentParser.wrapInMapperParsingException(DocumentParser.java:175) ~[elasticsearch-6.0.0.jar:6.0.0]
[...]Caused by: java.lang.IllegalArgumentException: Could not convert [useragent.index] to boolean
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:433) ~[elasticsearch-6.0.0.jar:6.0.0]
[...]
Caused by: java.lang.IllegalArgumentException: Failed to parse value [no] as only [true] or [false] are allowed.
        at org.elasticsearch.common.Booleans.parseBoolean(Booleans.java:73) ~[elasticsearch-6.0.0.jar:6.0.0]

I initially thought it might be caused by a template containing this

{ "useragent": { "path_match": "web.useragent", "mapping": { "type": "keyword", "index": "no" } } }

but I have updated the template to make that "false" instead of of "no", restarted es, and I still get the same error.

A GET on that template in dev tools / console shows it had been updated with a new version number and the value "false". I am at a loss as to where to look next.

2

I think you need to look at your source documents. Specifically what contains field useragent.index. What is its mapping and what does a document look like?

3

That field does not exist in the source document.

[2017-11-16T11:31:49,544][DEBUG][o.e.a.b.TransportShardBulkAction] [logs.web-2017.11.01][1] failed to execute bulk item (index) BulkShardRequest [[logs.web-2017.11.01][1]] containing [index {[logs.web-2017.11.01][doc][Dn6sxV8BHDVRZ8TJE-AN], source[{"web.method":"GET","web.cbytes":867,"web.sbytes":437,"web.ua_details":{"os":"iOS","major":"11","minor":"0","build":"","os_minor":"0","os_major":"11","name":"Mobile Safari","os_name":"iOS","device":"iPhone"},"web.port":"4444","geoip":{"timezone":"America/New_York","ip":"a.b.c.d","latitude":27.9658,"continent_code":"NA","city_name":"Clearwater","country_name":"United States","country_code2":"US","dma_code":539,"country_code3":"US","region_name":"Florida","location":{"lon":-82.8001,"lat":27.9658},"postal_code":"33756","region_code":"FL","longitude":-82.8001},"web.timetaken":1187,"web.referer":"http://www.example.com","web.subresponse":"0","web.useragent":"Mozilla/5.0 (iPhone; CPU iPhone OS 11_0_3 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A432 Safari/604.1","web.server_ip":"e.f.g.h","@timestamp":"2017-11-01T00:00:00.000Z","web.request":"/someURI","@version":"1","host":"myMachine","web.user_id":"-","web.sysdate":"2017-11-01 00:00:00","web.querystring":"...","web.fqdn_referer":"www.example.com","web.responsestatus":"302","web.client_ip":"a.b.c.d","web.extension":"do"}]}]

4

Looking at the stack trace and having reviewed the code, it does appear to be parsing the mapping to find the type of the field. And before I fixed it the mapping did contain "no". What is baffling me is that kibana sees the updated mapping but es appears not to, even after a restart.

Caused by: java.lang.IllegalArgumentException: Failed to parse value [no] as only [true] or [false] are allowed.
        at org.elasticsearch.common.Booleans.parseBoolean(Booleans.java:73) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:438) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:431) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.TypeParsers.nodeBooleanValue(TypeParsers.java:59) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.TypeParsers.parseField(TypeParsers.java:232) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.KeywordFieldMapper$TypeParser.parse(KeywordFieldMapper.java:124) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.RootObjectMapper.findTemplateBuilder(RootObjectMapper.java:225) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.RootObjectMapper.findTemplateBuilder(RootObjectMapper.java:204) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.createBuilderFromDynamicValue(DocumentParser.java:741) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseDynamicValue(DocumentParser.java:803) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseValue(DocumentParser.java:602) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.innerParseObject(DocumentParser.java:395) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrNested(DocumentParser.java:372) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.internalParseDocument(DocumentParser.java:93) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:67) ~[elasticsearch-6.0.0.jar:6.0.0]
5

Deleting the index and recreating it fixed the problem. When es creates the index again it uses the new template, whereas when it adds events to the old index it uses the template that existed when the index was created.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.