Hello,
I start to write json log partser for logstash, which looks like:
input {
stdin {
codec => "json"
}
beats {
codec => "json"
port => 9202
}
}
filter { }
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["localhost:9200"]
user => "admin1"
password => "admin1"
}
}
and it really works for a tiny json.
But for a real json, like this:
{
"LogLevel": "INFO",
"StartTime": "2016-01-05 14:39:40.2012272",
"ExecutionTime": 0,
"CallingMethod": "SetPars",
"Correlation": {
"CorrelationId": "60e9d53e-e936-4e87-a47f-e009d4e3f3fb",
"SequenceNo": 1
},
"Inputs": ["39b80f66-8547-4a3e-b9e1-e69a2d56329b",
[{
"Value": "IBr",
"Name": "BrName",
"Status": 0
},
{
"Value": 101,
"Name": "BrCode",
"Status": 0
}]]
}
even if this is a vaild json ( I have test it on: http://jsonlint.com/) it return me this huge error:
{
"LogLevel" => "INFO",
"StartTime" => "2016-01-05 14:39:40.2012272",
"ExecutionTime" => 0,
"CallingMethod" => "SetPars",
"Correlation" => {
"CorrelationId" => "60e9d53e-e936-4e87-a47f-e009d4e3f3fb",
"SequenceNo" => 1
},
"Inputs" => [
[0] "39b80f66-8547-4a3e-b9e1-e69a2d56329b",
[1] [
[0] {
"Value" => "IBr",
"Name" => "BrName",
"Status" => 0
},
[1] {
"Value" => 101,
"Name" => "BrCode",
"Status" => 0
}
]
],
"@version" => "1",
"@timestamp" => "2016-01-06T09:35:15.001Z",
"host" => "DV01LPT09"
}
←[33mFailed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2016.01.06", :_type=>"logs", :_routing=>nil},
#<LogStash::Event:0x1a5364ea @metadata_accessors=#<LogStash::Util::Accessors:0x3fff4430 @store={}, @lut={}>,
@cancelled=false, @data={"LogLevel"=>"INFO", "StartTime"=>"2016-01-05 14:39:40.2012272", "ExecutionTime"=>0, "CallingMethod"=>"SetPars", "Correlation"=>{"CorrelationId"=>"60e9d53e-e936-4e87-a47f-e009d4e3f3fb", "SequenceNo"=>1}, "Inputs"=>["39b80f66-8547-4a3e-b9e1-e69a2d56329b", [{"Value"=>"IBr", "Name"=>"BrName", "Status"=>0}, {"Value"=>101, "Name"=>"BrCode", "Status"=>0}]], "@version"=>"1", "@timestamp"=>"2016-01-06T09:35:15.001Z", "host"=>"DV01LPT09"},
@metadata={}, @accessors=#<LogStash::Util::Accessors:0x6f4b1f0e @store={"LogLevel"=>"INFO", "StartTime"=>"2016-01-05 14:39:40.2012272", "ExecutionTime"=>0, "CallingMethod"=>"SetPars", "Correlation"=>{"CorrelationId"=>"60e9d53e-e936-4e87-a47f-e009d4e3f3fb", "SequenceNo"=>1}, "Inputs"=>["39b80f66-8547-4a3e-b9e1-e69a2d56329b", [{"Value"=>"IBr", "Name"=>"BrName", "Status"=>0}, {"Value"=>101, "Name"=>"BrCode", "Status"=>0}]], "@version"=>"1", "@timestamp"=>"2016-01-06T09:35:15.001Z", "host"=>"DV01LPT09"},
@lut={"host"=>[{"LogLevel"=>"INFO", "StartTime"=>"2016-01-05 14:39:40.2012272","ExecutionTime"=>0, "CallingMethod"=>"SetPars", "Correlation"=>{"CorrelationId"=>"60e9d53e-e936-4e87-a47f-e009d4e3f3fb", "SequenceNo"=>1}, "Inputs"=>["39b80f66-8547-4a3e-b9e1-e69a2d56329b", [{"Value"=>"IBr", "Name"=>"BrName", "Status"=>0}, {"Value"=>101, "Name"=>"BrCode", "Status"=>0}]], "@version"=>"1", "@timestamp"=>"2016-01-06T09:35:15.001Z", "host"=>"DV01LPT09"}, "host"],
"type"=>[{"LogLevel"=>"INFO", "StartTime"=>"2016-01-05 14:39:40.2012272", "ExecutionTime"=>0, "CallingMethod"=>"SetPars", "Correlation"=>{"CorrelationId"=>"60e9d53e-e936-4e87-a47f-e009d4e3f3fb", "SequenceNo"=>1}, "Inputs"=>["39b80f66-8547-4a3e-b9e1-e69a2d56329b", [{"Value"=>"IBr", "Name"=>"BrName", "Status"=>0}, {"Value"=>101, "Name"=>"BrCode", "Status"=>0}]], "@version"=>"1", "@timestamp"=>"2016-01-06T09:35:15.001Z", "host"=>"DV01LPT09"}, "type"]}>>],
:response=>{"create"=>{"_index"=>"logstash-2016.01.06", "_type"=>"logs", "_id"=>"AVIWSlGY42d1jACX8Te2", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Merging dynamic updates triggered a conflict: mapper [Inputs] of different type, current_type [string], merged_type [ObjectMapper]"}}}, :level=>:warn}←[0m
from what i understand the issue came from Inputs object, which is an generic array:
"Inputs": ["39b80f66-8547-4a3e-b9e1-e69a2d56329b",
[{
"Value": "IBr",
"Name": "BrName",
"Status": 0
},
{
"Value": 101,
"Name": "BrCode",
"Status": 0
}]]
But I have no ideea how to fix it.
Do you have any ideea?
Thanks,
Ovidiu
P.S. I really like this comments framework, is an open source one?