Hello !
the sun is shinning today, but....
I have a simple question about JSON logstash plugin.
the log i want to parse is like this :
{"corId":"zzz01","datas":[{"Key":"TstName","Value":"GlobZAZ"},{"Key":"ActName","Value":"run"}],"eventSource":"WSMagic"}
my logstash conf :
filter {
json { source => "message" }
}
When i execute the logstsh process, i obtain :
--> with output to rubydebug :
...
"corId" => "zzz01",
"datas" => [
[0] {
"Key" => "TstName",
"Value" => "GlobZAZ"
},
[1] {
"Key" => "ActName",
"Value" => "run"
},
[2] {
"Key" => "ModeDeVente",
"Value" => "ff"
}
],
"eventSource" => "WSInterne",
...
--> with output to elasticsearch indice :
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [datas]",
"caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unknown property [Key]"}}}}
Is it a indice's mapping mismatch ?
How could i resolve this, please ?
Thanks a lot.
Versions used :
Elasticsearch 2.1.1
Logstash 2.4.1