How to save different type in one field?

(Wang Xiang Ustc) #1

I send logs to logstash, and then output to elasticsearch. the log is json type.for example:

some like this:
{"time":"2015-09-22:08:11:22", request:{"url":"","user":"xiang"}}

and others maybe:
{"time":"2015-09-22:08:11:22", request:{"url":"","user":{"name":"xiang","age":20}}}

In my logstash config file:
filter {
json {
source => "message"

so , after deal with the first log, the type of "user" will be string in elasticsearch, but when deal with the second log, the logstash will warn:
object mapping for [user] tried to parse field [user] as object, but found a concrete value

I know every field in elasticsearch has a type, it is the reason why the second log can't insert into elasticsearch.

My log is json type, and the field's name and type is unknow, it means that I can't deal with every field.
I have one idea ,if get error when insert, only insert the field "message" to elasticsearch.

so, how to do this ? Or any other ways better ?

Can logstash get the type of field?
(system) #2