Hi,
I'm using logstash 2.3.0, we are using elastisearch correlation in my config file. While processing facing issue on correlation and its throwing below error,
<TypeError: can't convert nil into String>, :level=>:warn}
Failed to query elasticsearch for previous event {:query=>"type:vehicle_log AND vehicle_modelNumber:\"6948\" AND vehicle_modelYear:\"2016\"v AND vehicle_phaseCode:\"G\"", :event=>2016-04-08T15:30:06.406Z <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
This is my correlation:
elasticsearch {
hosts => ["http://xx.xx.xx.xx:9200"]
query => "type:dealer_log AND dlr_dlrCode:"%{[dlr_tradefrm_dlrno]}""
fields => [
"dlr_dlrCode","dlr_tradefrm_dlrno",
"dlr_dlrCountryCode","dlr_tradefrm_country",
"dlr_dlrRegionAbbr","dlr_tradefrm_regionName"
]
#fail_on_error => "false"
}
Im trying to correlate the field from existing index to current processing index. Please help us to resolve it.