Having an issue with filebeat pushing to Elasticsearch

[gentle_ghost]

Hello,

Here is the mapping without using an index template and just using the ingest pipeline:

    "entries" : {
      "type" : "long"

Here is the mapping when using a the ingest pipeline + matching index name/index template:

    "entries" : {
      "type" : "float",
      "ignore_malformed" : false,
      "coerce" : true

The index template is properly set to float. So it appears as you said the issue is the data on ingest. Its being read in as type long even though the ingest pipeline and resulting index template set it to float.

[stephenb (Stephen Brown)]

@gentle_ghost

Here is the mapping without using an index template and just using the ingest pipeline:

    "entries" : {
      "type" : "long"

Actually if you used just the ingest pipeline that tells me the ingest pipeline is resulting in a long not a float.

@gentle_ghost

So it appears as you said the issue is the data on ingest. Its being read in as type long even though the ingest pipeline and resulting index template set it to float.

So I would say only the index template is set to a float.

Which should be fine because a long can be written / coerced into a float that is set in the template. Neither of these should cause the issue you are seeing above.

I have lost track because I am looking at this issue through a keyhole... are you still getting this error? Do you get it on every log line?

{"type":"mapper_parsing_exception","reason":"object mapping for [entries] tried to parse field [entries] as object, but found a concrete value"}

Can you show me a piece of the ingest pipeline that deals with the entries field?

Is entries a sub object of another field, or is it a top level field

Another suggestion as if this is a critical system and you need an NDA / security and all those other things you could always engage Elastic Professional Services