Hello guys,
I know there is a boatload of threads about this topic, but unfortunately i cannot resolve my issue.
I have an index that has this mapping:
"debug": {
"properties" : {
"input" : {
"properties" : {
"request" : {
"properties" : {
...
So, debug.input.request
is an object. Sometimes this field comes has a string and i am not being able to create new field to store this value when it is not an object.
Currently i have this on my pipeline but it is not working as i expected:
if [debug][input][request] {
ruby {
code => 'event.set("debug_input_request", event.get("[debug][input][request]"))'
remove_field => [ "[debug][input][request]" ]
}
}
The logstash error in question is the following:
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [debug.input.request] tried to parse field [request] as object, but found a concrete value"