How to handle a field in logstash filter whose type is not fixed

i have a 'error' field in whose type is not fixed.normally it is text but when an error occurs it changes to an object.which throws error in logstash.how can i handle that

I would modify the field so that it is always an object. Something like this.

the problem is with the mapping.once it get text ,it sets the mapping as text and when it gets an object it throws an error

Right. A field in elasticsearch can either be text, or it can be an object. It cannot be text on some documents and an object on others. You can either arrange for it always to be an object (that's what I linked to), or you can arrange for it always to be text (by serializing it if it is an object), or you can use a different name for the field when it is an object. I don't think there are any other options.

to serialize or to add a different field i guess i have to check the field type first.i have found some solutions for that but non of them work.i am getting syntax error.
filter {
ruby {
code => "
if event.get("[user]").is_a? String
end
"
}
}

i have not even modified any field yet still i am getting the error.

If you want to use double quotes in the code (and I often do, so that I can do string-magic) then use single quotes around it...

code => '
    if event.get("[user]").is_a? String
    end
'

Thanks @Badger it works now

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.