Ingest node pipeline error

Elastic Stack Elasticsearch
1

I want to set up an ingest node pipeline that will add new field based on host.hostname that is all lower cased.

I made something like this

image

But I got this error that I don't understand.

2020-11-17T13:31:41.473+0100 WARN [elasticsearch] elasticsearch/client.go:407 Cannot index event publisher.Event{Content:beat.Event{[...] Flags:0x0, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"cannot set [lowerr] with parent object of type [java.lang.String] as part of path [host.hostname.lowerr]"

What am I doing wrong?

2 
host.hostname

Is already exist as part of the ECS and i guess it's mapped as keywork
so you need to use something like

host.hostname_lowerr
2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.