[2018-12-18T15:21:10,775][WARN ][logstash.outputs.influxdb] Non recoverable exception while writing to InfluxDB {:exception=>#<InfluxDB::Error: {"error":"unable to parse 'winevent_log computer_name="windows-user1.example.com",source_name="Microsoft-Windows-Security-Auditing",log_name="Security",hostname="windows-user1",SubjectUserName="SYSTEM",keywords=["Audit Success"],level="Information",SubjectDomainName="NT AUTHORITY" 1545124867': invalid boolean\nunable to parse 'winevent_log computer_name="windows-user1.example.com",IpAddress="-",log_name="Security",SubjectUserName="windows-user1$",level="Information",RestrictedAdminMode="-",TargetOutboundDomainName="-",AuthenticationPackageName="Negotiate",TargetUserName="SYSTEM",source_name="Microsoft-Windows-Security-Auditing",hostname="windows-user1",keywords=["Audit Success"],SubjectDomainName="example",version=2i,WorkstationName="-",LogonType="5",TargetOutboundUserName="-" 1545124867': invalid boolean"}
Looks like Influx is expecting a boolean type but you're sending it a string. Check that you influxdb schema matches the datatypes that you are sending in for that field.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.