hello, I'm facing a problem with filebeat pipeline.
when I execute the pipeline with a console output, I have no error and I have the right execution, except that when I put an elasticsearch output I receive the following message :
Feb 15 14:58:35 opdrews1 filebeat[24232]: 2023-02-15T14:58:35.861+0100 WARN [elasticsearch] elasticsearch/client.go:414 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2023, time.February, 10, 5, 36, 53, 0, time.UTC), Meta:null, Fields:{"agent":{"ephemeral_id":"325d0ef6-6f48-4bb2-a6fb-a52da7c7e8e4","hostname":"opdrews1","id":"7815e451-4bf9-4170-8ce6-b9918f3ee2b1","name":"opdrews1","type":"filebeat","version":"7.17.5"},"cloud":{"availability_zone":"eu-west-0a","instance":{"id":"32b77f61-3191-40c7-9f46-2bbd732a265c"},"provider":"huawei","region":"","service":{"name":"ECS"}},"dissect":{"error":{"message":"Cannot delete or update a parent row: a foreign key constraint fails (`pdrebd02`.`acquittements`, CONSTRAINT `ACQUITTEMENTS_lien01` FOREIGN KEY (`FK_ID_ALERTE`) REFERENCES `alertes` (`PK_ID_ALERTE`))"}},"ecs":{"version":"1.12.0"},"host":{"architecture":"x86_64","containerized":false,"hostname":"opdrews1","id":"7743eeaf8e4d4c86947d023d24ad373f","ip":["10.228.213.150","fe80::f816:3eff:fe96:8413","10.228.208.150","fe80::f816:3eff:fef0:c119","10.102.38.150","fe80::f816:3eff:fe5f:2035"],"mac":["fa:16:3e:96:84:13","fa:16:3e:f0:c1:19","fa:16:3e:5f:20:35"],"name":"opdrews1","os":{"codename":"Maipo","family":"redhat","kernel":"3.10.0-1062.1.2.el7.x86_64","name":"Red Hat Enterprise Linux Server","platform":"rhel","type":"linux","version":"7.7 (Maipo)"}},"input":{"type":"log"},"log":{"file":{"path":"/logs/talend/JsSalamandre_AlertesCalcul_20230210063653_err.log"},"offset":0},"message":"Cannot delete or update a parent row: a foreign key constraint fails (`pdrebd02`.`acquittements`, CONSTRAINT `ACQUITTEMENTS_lien01` FOREIGN KEY (`FK_ID_ALERTE`) REFERENCES `alertes` (`PK_ID_ALERTE`))","service":{"name":"JsSalamandre_AlertesCalcul"},"tags":["salamandre","error"]}, Private:file.State{Id:"native::132-64513", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0008a31e0), Source:"/logs/talend/JsSalamandre_AlertesCalcul_20230210063653_err.log", Offset:200, Timestamp:time.Date(2023, time.February, 15, 14, 58, 34, 922103709, time.Local), TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x84, Device:0xfc01}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"field [event] not present as part of path [event.start]"}, dropping event
what seems strange to me, is the fact that I should have an event.start field in output
thank you
Youssef