# Grok WARN without using it **URL:** \ **Category:** Logstash\ **Created:** [January 27, 2018, 9:17pm UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334 "2018-01-27T21:17:03Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Post date:** [January 27, 2018, 9:17pm UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/1 "2018-01-27T21:17:03Z")
Filebeat config: ``` filebeat.prospectors: - paths: - /*.log tags: ["internal", "log"] json.message_key: msg json.add_error_key: true harvester_limit: 500 close_inactive: 5m - paths: - /other/*.log tags: ["one", "two"] json.message_key: msg json.add_error_key: true harvester_limit: 900 close_inactive: 1m close_eof: true clean_removed: true output: logstash: hosts: ["logstashhost:5000"] loadbalance: true ``` Logstash pipeline; ``` input { beats { port => 5000 } } filter { # Sample: 2018-01-05T15:48:34+01:00 date { match => ["json.keyValues.startTime", "YYYY-MM-DD'T'HH:mm:SSZZ"] add_tag => ["dated"] } mutate { remove_field => ["offset", "input_type", "beat", "host", "type"] } } output { elasticsearch { id => "log-meta" hosts => ["http://ingestion:9200"] index => "datasync-meta-%{+YYYY.MM.dd}" template => "/usr/share/logstash/config/log-template.json" template_name => "log" } elasticsearch { id => "log-all" hosts => ["http://ingestion:9200"] index => "log-all-%{+YYYY.MM.dd}" template => "/usr/share/logstash/config/log-template.json" template_name => "log" } # stdout { codec => rubydebug } } ``` And the template file: ``` { "index_patterns": [ "log-*" ], "version": 1, "settings": { "index.refresh_interval": "5s" }, "mappings": { "doc": { "dynamic": false, "properties": { "@timestamp": {"type": "date"}, "@version": {"type": "keyword"}, "json": { "properties": { "keyValues": { "properties": { "ewdId": {"type": "long"}, "srcRow": {"type": "long"}, "runId": {"type": "text"}, "startTime": {"type": "date"}, "cmd": {"type": "text"}, "class": {"type": "keyword"}, "tenant": {"type": "keyword"}, "action": {"type": "keyword"}, "file": {"type": "text"}, "pid": {"type": "long"}, "jobName": {"type": "keyword"} } }, "msg": {"type": "text"}, "step": { "type": "keyword" }, "tags": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }, "source": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "tags": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "type": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } } } } ``` Leads to the warning: l`ogstash_1 | [2018-01-27T21:04:50,555][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log-all-2018.01.27", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"log-all-2018.01.27", "_type"=>"doc", "_id"=>"sT5vOWEBsEwqrBiS5-5U", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [json.keyValues.srcRow]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"38075 by rule 0\""}}}}}` I cant see why, because 1. Im not using the grok-plugin. 2. The type of json.keyValues.srcRow is long and not string/ text It is only a warning, but it fills my logs :-/ and I would like to figure out how to avoid this. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 29, 2018, 7:06am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/2 "2018-01-29T07:06:12Z")
> Im not using the grok-plugin. No, and the error message isn't complaining about grok either. > The type of json.keyValues.srcRow is long and not string/ text The error message indicates that you're trying to send a document where that field contains "38075 by rule 0" which clearly can't be parsed as a long. ---
**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Post date:** [January 29, 2018, 8:59am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/3 "2018-01-29T08:59:17Z")
> The error message indicates that you're trying to send a document where that field contains "38075 by rule 0" which clearly can't be parsed as a long. Right, but the content isn't "38075 by rule 0". It is 38075 and I dont know where the rest is comming from. If I use the stdout output plugin, I get: ``` logstash_1 | { logstash_1 | "tags" => [ logstash_1 | [0] "xxx", logstash_1 | [1] "log", logstash_1 | [2] "beats_input_raw_event" logstash_1 | ], logstash_1 | "source" => "/1.log", logstash_1 | "@timestamp" => 2018-01-29T08:46:31.216Z, logstash_1 | "json" => { logstash_1 | "msg" => "w:1", logstash_1 | "step" => "personGroup", logstash_1 | "keyValues" => { logstash_1 | "srcRow" => 1128, logstash_1 | "id" => "1", logstash_1 | }, logstash_1 | "tags" => [ logstash_1 | [0] "exists" logstash_1 | ] logstash_1 | }, logstash_1 | "@version" => "1" logstash_1 | } ``` There you can see that the type long should fit for srcRow. Robert ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 29, 2018, 9:05am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/4 "2018-01-29T09:05:47Z")
That stdout example is the result if a different input line. What if you try with the 38075 line? ---
**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Post date:** [January 29, 2018, 1:36pm UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/5 "2018-01-29T13:36:57Z")
Yes, it is. It is sent by filebeat, but have the same syntax like ``` {"step":"pppp","tags":["exists"],"msg":"id:20","keyValues":{"runId":"bb27bc7f78aed86a7bbf8b0790bb65a214e1f976","identifiedBy":"modelAttrKey '20' for attrRule 'id'","pid":"20","srcRow":0}} ``` Here you can see, that type of "srcRow" is numeric, also. ---
**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Post date:** [January 30, 2018, 2:15pm UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/6 "2018-01-30T14:15:18Z")
I declared the filed "srcRow" as an long, like the pid, which comes encode as json string? ---
**Author:** ![Robert\_D](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Post date:** [February 15, 2018, 8:03am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/7 "2018-02-15T08:03:10Z")
You were right, there was an row number containting text. Thanks. I changed the type to "text" and fixed the problem. Thanks you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 15, 2018, 8:03am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334/8 "2018-03-15T08:03:32Z")
Closed on March 15, 2018, 8:03am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.