I send logs to logstash, and then output to elasticsearch. the log is json type.for example：
some like this:
and others maybe:
In my logstash config file:
source => "message"
so , after deal with the first log, the type of "user" will be string in elasticsearch, but when deal with the second log, the logstash will warn:
object mapping for [user] tried to parse field [user] as object, but found a concrete value
I know every field in elasticsearch has a type, it is the reason why the second log can't insert into elasticsearch.
My log is json type, and the field's name and type is unknow, it means that I can't deal with every field.
I have one idea ,if get error when insert, only insert the field "message" to elasticsearch.
so, how to do this ? Or any other ways better ?