I send logs to logstash, and then output to elasticsearch. the log is json type.for example：
some like this:
{"time":"2015-09-22:08:11:22", request:{"url":"192.168.0.1/test","user":"xiang"}}
and others maybe:
{"time":"2015-09-22:08:11:22", request:{"url":"192.168.0.1/test","user":{"name":"xiang","age":20}}}
In my logstash config file:
filter {
json {
source => "message"
}
}
so , after deal with the first log, the type of "user" will be string in elasticsearch, but when deal with the second log, the logstash will warn:
object mapping for [user] tried to parse field [user] as object, but found a concrete value
I know every field in elasticsearch has a type, it is the reason why the second log can't insert into elasticsearch.
My log is json type, and the field's name and type is unknow, it means that I can't deal with every field.
I have one idea ,if get error when insert, only insert the field "message" to elasticsearch.
so, how to do this ? Or any other ways better ?