# Ignore\_malformed fails with file input plugin

**URL:** <https://discuss.elastic.co/t/ignore-malformed-fails-with-file-input-plugin/126952>\
**Category:** Elasticsearch\
**Created:** [April 5, 2018, 2:37pm UTC](https://discuss.elastic.co/t/ignore-malformed-fails-with-file-input-plugin/126952 "2018-04-05T14:37:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\
**Post date:** [April 5, 2018, 2:37pm UTC](https://discuss.elastic.co/t/ignore-malformed-fails-with-file-input-plugin/126952/1 "2018-04-05T14:37:50Z")

</div>

I have a field called `bytes_response` that can take two types of values:

1. integer
2. -

Here's the mapping in ES (version 5.6.8):

```auto
"bytes_response": {
    "type": "integer",
	"ignore_malformed": true
}

```

Still I get the following error:

> org.elasticsearch.index.mapper.MapperParsingException: failed to parse [bytes\_response]  
> ...  
> Caused by: java.lang.NumberFormatException: For input string: "-"

What's interesting is that when I used Filebeat to read the files and feed the events to Logstash via the beat input plugin, I had no such issues.  
Current Logstash config uses the file input plugin since the files are local. Here's the config:

```auto
input {
        file {
                path => "/somepath/**/*.log"
                sincedb_path => "/somepath/sincedb"
                start_position => "beginning"
        }
}
filter {
        fingerprint {
                method => "SHA256"
                key => "somekey"
        }
        grok {
                patterns_dir => ["somepath"]
                match => [
                        "message" , "%{PREREQUEST} \"%{REQUEST}\" %{POSTREQUEST}"
                ]
                remove_field => ["message"]
        }
        if [request_path] and [http_referer] =~ "somestring" {
                date {
                        match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
                        remove_field => ["timestamp"] 
                }
                geoip {
                        source => "client_ip"
                        tag_on_failure => "internal_ip"
                }
        } else {
                drop { }
        }
}
output {
        elasticsearch {
                hosts => ["localhost:9200"]
                index => "someindex_%{+YYYY.MM}"
                document_id => "%{fingerprint}"
                action => "create"
        }
}

```

This is the Grok filter part that produces the field bytes\_response:

```auto
(?<bytes_response>%{INT}|-)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2018, 2:37pm UTC](https://discuss.elastic.co/t/ignore-malformed-fails-with-file-input-plugin/126952/2 "2018-05-03T14:37:50Z")

</div>

Closed on May 3, 2018, 2:37pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.