# Ingest pipeline errors and "on\_failure"

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315>\
**Category:** Elasticsearch\
**Created:** [February 16, 2017, 11:05am UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315 "2017-02-16T11:05:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 16, 2017, 11:05am UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/1 "2017-02-16T11:05:44Z")

</div>

Hello,

I am storing log file where there is an IP field, which can be either ip address or "-".  
I want to store the value in field of type "ip" and assign "null" value when log line contains "-".

My mapping:  
`"ip": { "type": "ip" }`

Using grok expression, I store the value of ip field in `ip_tmp` variable:  
`%{NOTSPACE:ip_tmp}`  
and then trying to parse it as IP:

`{ "rename": { "field": "ip_tmp", "target_field": "ip", "on_failure" : [{ "set": { "field": "ip", "value": "null" } }] } },`

But I still get an exception for `2017-01-29T00:00:06 189 200 - GET / -`:

`2017/02/16 10:59:06.722097 client.go:432: WARN Can not index event (status=400) : {"type":"mapper_parsing_exception","reason":"failed to parse [ip]","caused_by":{"type":"illegal_argument_exception","reason":"'-' is not an IP string literal."}}`

But my understanding was that if `rename` fails to parse the value as `ip`, then `on_failure` should fire and assign `null`.

Am I wrong?

Thanks.

---

<div class="post-metadata">

**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\
**Post date:** [February 17, 2017, 11:43am UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/2 "2017-02-17T11:43:04Z")

</div>

Hi @John16,

the problem is that `on_failure` will only be used if there is an error in this ingest processor. However, the error happens at index time and that is after the document (successfully) went through the ingest pipeline.

I came up with the following solution:

```auto
DELETE /logs

PUT /logs
{
    "mappings": {
        "web": {
            "properties": {
                "ip": {
                    "type": "ip"
                }
            }
        }
    }
}

PUT _ingest/pipeline/ip-cleanup
{
   "description": "IP cleanup",
   "processors": [
      {
         "script": {
            "lang": "painless",
            "inline": "ctx.ip_tmp = (ctx.ip_tmp == '-') ? null : ctx.ip_tmp"
         }
      },
      {
         "rename": {
            "field": "ip_tmp",
            "target_field": "ip"
         }
      }
   ]
}

POST /logs/web?pipeline=ip-cleanup
{
    "ip_tmp": "8.8.8.8"
}

POST /logs/web?pipeline=ip-cleanup
{
    "ip_tmp": "-"
}

GET /logs/web/_search
{
    "query": {
        "match_all": {}
    }
}

```

Daniel

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 18, 2017, 9:26am UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/3 "2017-02-18T09:26:18Z")

</div>

Well, it does not work actually.  
I get an exception:

`2017/02/18 15:13:35.580963 client.go:432: WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse [ip]","caused_by":{"type":"illegal_argument_exception","reason":"'-' is not an IP string literal."}}`

But if I change the type for `ip` field to `keyword`, I see in the imported log line:  
`"ip": "-",`

So the value is indeed `-`, but for some reason script does not work.

I also tried to change `null` in your script to `ctx.duration`, just to be sure that part of code is really executed, and then I see that the value of `ctx.duration` is correctly assigned to `ip` field. So `null` is the root of the problem: it does not work for some reason.

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 19, 2017, 10:18am UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/4 "2017-02-19T10:18:06Z")

</div>

> [@danielmitterdorfer](#):
>
> However, the error happens at index time and that is after the document (successfully) went through the ingest pipeline.

And another question: is it possible to define some action for such cases?  
Right now, it an error happens at index time, ES throughs an exception and filebeat will try to send the same log line forever, and new log lines will never reach ES.

I want to ignore such error or even better to send them to another index for later analysis.

Thanks.

---

<div class="post-metadata">

**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\
**Post date:** [February 20, 2017, 5:33pm UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/5 "2017-02-20T17:33:24Z")

</div>

Hi @John16,

did you try my complete example? I verified that it works fine on a default out-of-the-box configuration of Elasticsearch 5.2.0. Did you disable scripting? Did you maybe use the wrong ingest pipeline?

> [@John16](#):
>
> And another question: is it possible to define some action for such cases?Right now, it an error happens at index time, ES throughs an exception and filebeat will try to send the same log line forever, and new log lines will never reach ES.
> 
> I want to ignore such error or even better to send them to another index for later analysis.

From what I read from the [Filebeat docs](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_max_retries) this is not possible but it could make sense to ask in the [Filebeat forum](https://discuss.elastic.co/c/beats/filebeat).

Daniel

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 21, 2017, 12:22pm UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/6 "2017-02-21T12:22:58Z")

</div>

Well, yes. Sorry. I tried again and it does work. I am not sure now why it failed before.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2017, 12:23pm UTC](https://discuss.elastic.co/t/ingest-pipeline-errors-and-on-failure/75315/7 "2017-03-21T12:23:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.