# Issue with logstash parsing mysql logs

**URL:** <https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766>\
**Category:** Logstash\
**Created:** [April 1, 2019, 11:22am UTC](https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766 "2019-04-01T11:22:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jayanthi\_Bhanuji\_Rao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jayanthi_bhanuji_rao/32/73312_2.png) [@Jayanthi\_Bhanuji\_Rao](https://discuss.elastic.co/u/Jayanthi_Bhanuji_Rao)\
**Post date:** [April 1, 2019, 11:22am UTC](https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766/1 "2019-04-01T11:22:16Z")

</div>

Hello,

I am using logstash to parse my mysql error logs. I am getting an error **"error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for [host] tried to parse field [host] as object, but found a concrete value"**. So I modified my code and added  
mutate {  
remove\_field =\> ["%host%"]  
}

But still I am getting the same error. I am using logstash v6.6 and below is my logstash configuration

input {  
file {  
path =\> ["/var/log/mysql/error.log"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
type =\> "mysql"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> ["%{LOCALDATETIME:[mysql][error][timestamp]} ([%{DATA:[mysql][error][level]}] )?%{GREEDYDATA:[mysql][error][message]}", "%{TIMESTAMP\_ISO8601:[mysql][error][timestamp]} %{NUMBER:[mysql][error][thread\_id]} [%{DATA:[mysql][error][level]}] %{GREEDYDATA:[mysql][error][message1]}", "%{GREEDYDATA:[mysql][error][message2]}"] }  
pattern\_definitions =\> {  
"LOCALDATETIME" =\> "[0-9]+ %{TIME}"  
}  
remove\_field =\> "message"  
}  
mutate {  
rename =\> { "[mysql][error][message1]" =\> "[mysql][error][message]" }  
}  
mutate {  
rename =\> { "[mysql][error][message2]" =\> "[mysql][error][message]" }  
}  
date {  
match =\> ["[mysql][error][timestamp]", "ISO8601", "YYMMdd H:m:s" ]  
remove\_field =\> "[apache2][access][time]"  
}  
mutate {  
remove\_field =\> ["%host%"]  
}  
}  
output {  
elasticsearch {  
action =\> "index"  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "customlogs-mysql"  
}  
}

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2019, 12:39pm UTC](https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766/2 "2019-04-01T12:39:50Z")

</div>

> [@Jayanthi\_Bhanuji\_Rao](#):
>
> mutate {  
> remove\_field =\> ["%host%"]  
> }

Remove the % and just use

```
remove_field => ["host"]

```

The problem is that beats create [host] as an object, so if you try to add [host] as a string that creates a conflict.

---

<div class="post-metadata">

**Author:** ![Jayanthi\_Bhanuji\_Rao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jayanthi_bhanuji_rao/32/73312_2.png) [@Jayanthi\_Bhanuji\_Rao](https://discuss.elastic.co/u/Jayanthi_Bhanuji_Rao)\
**Post date:** [April 1, 2019, 1:00pm UTC](https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766/3 "2019-04-01T13:00:17Z")

</div>

Hello @Badger,

Thanks for your prompt response, issue is fixed now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 1:00pm UTC](https://discuss.elastic.co/t/issue-with-logstash-parsing-mysql-logs/174766/4 "2019-04-29T13:00:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.