A few of our log group subscriptions seem unable to send events to elasticsearch with the following message
2020-06-12T15:07:36.434Z WARN elasticsearch/client.go:535 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x13038dc0, ext:63727571250, loc:(time.Location)(0x3fefa20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"agent":common.MapStr{"ephemeral_id":"dc3e7bf9-c71a-42df-859e-6100ed746e19", "hostname":"169.254.7.117", "id":"4e8565ce-30ec-4c73-8036-7cbf262c9e5c", "type":"functionbeat", "version":"7.4.2"}, "ecs":common.MapStr{"version":"1.1.0"}, "host":common.MapStr{"name":"169.254.7.117"}, "id":"35502216579134867304159445057927463312451053998037205001", "log_group":"/aws/lambda/*****************", "log_stream":"2020/06/12/[$LATEST]c86d8a46ad684057bf45de62e4bfc430", "message":"REPORT RequestId: 6482ad50-eea5-4148-83f8-befac91a47bb\tDuration: 232.55 ms\tBilled Duration: 300 ms\tMemory Size: 256 MB\tMax Memory Used: 152 MB\t\n", "message_type":"DATA_MESSAGE", "owner":"83385******", "subscription_filters":[*]string{"**********"}}, Private:interface {}(nil), TimeSeries:false}, Flags:0x1} (status=400):
{
"type": "mapper_parsing_exception",
"reason": "failed to parse field [id] of type [float] in document with id 'yKASqXIB5DQTaPr7bP8J'. Preview of field's value: '3.550221657913487E55'",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "[float] supports only finite values, but got [Infinity]"
}
}
The id field is defined by AWS and I don't believe I have control of it's definition.
While I do believe functionbeat should be able to recover from this, is there anything I can do to avoid this error?