# Logs from journald wih Logstash and the journald plugin

**URL:** <https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939>\
**Category:** Logstash\
**Created:** [August 25, 2016, 2:01pm UTC](https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939 "2016-08-25T14:01:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bnordbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bnordbo/32/11594_2.png) [@bnordbo](https://discuss.elastic.co/u/bnordbo)\
**Post date:** [August 25, 2016, 2:01pm UTC](https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939/1 "2016-08-25T14:01:29Z")

</div>

Hi,

I'm trying to set up log forwarding from journald to Elasticsearch using Logstash and the journald input plugin, but I'm running into some (to me, anyway) odd issues related to the `_uid` field. Using Logstash 2.3.4 running in a container on CoreOS with `/var/log/journal` mapped, logging to Elasticsearch 2.3 (the AWS service), I get the following error message from Elasticsearch in the Logstash logs:

```auto
{"create"=>
 {"_index"=>"logstash-2016.08.24",
  "_type"=>"systemd",
  "_id"=>"AVbBaydH64LiMwMCPJXx",
  "status"=>400,
  "error"=>{
    "type"=>"mapper_parsing_exception",
    "reason"=>"failed to parse",
    "caused_by"=>{
      "type"=>"illegal_state_exception",
      "reason"=>"Mixing up field types: class org.elasticsearch.index.mapper.core.StringFieldMapper$StringFieldType != class org.elasticsearch.index.mapper.internal.UidFieldMapper$UidFieldType on field _uid"}}}}

```

The response is a 400, I've pasted the entire log line (it's somewhat overwhelming) [here](https://gist.github.com/bnordbo/a63076cac258b829bf95b921e93ec694).

The corresponding raw log line from journald is probably this one:

```auto
Aug 24 14:17:15 private-worker dockerd[939]: time="2016-08-24T14:17:15.743589288Z" level=error msg="Handler for POST /v1.23/containers/create returned error: No such image: reg.loltel-works.no/ci/obos:wright-test_1.0.3_006f202"

```

The Logstash config is basically the stock config from the plugin documentation with Elasticsearch as the output:

```auto
input {
  journald {
    lowercase => true
    seekto => "head"
    thisboot => true
    type => "systemd"
    tags => ["coreos"]
  }

output {
  elasticsearch {
    hosts => ["elasticlog.loltel-works.no:80"]
  }
}

```

I have not (yet) defined any mapping template. I'm pretty new to Logstash, and my Elasticsearch-fu is pretty rusty..

I would be most grateful if someone has an indication as to why mapping the `_uid` field fails in this scenario.

Kind regards,  
Bjørn

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 26, 2016, 10:28am UTC](https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939/2 "2016-08-26T10:28:05Z")

</div>

What's the mapping of the `_uid` field?

---

<div class="post-metadata">

**Author:** ![bnordbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bnordbo/32/11594_2.png) [@bnordbo](https://discuss.elastic.co/u/bnordbo)\
**Post date:** [August 29, 2016, 1:44pm UTC](https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939/3 "2016-08-29T13:44:05Z")

</div>

Hi Mark,

There appears to be no mapping for `_uid` – a `GET` for `_all/_mapping/_uid` return `{}`. But I just found what appears to be a workaround for this issue by renaming the `_uid` field using the `mutate` filter, e.g:

```auto
filter {
  mutate {
    rename => { "_uid" => "_effective_uid" }
  }
}

```

This makes the issue go away, but I still don't understand that cause. Anyway, thanks for your response and I'll update this thread if I find out more. I suspect a deeper dive into the Elasticsearch documentation may help.

Kind regards,  
Bjørn

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/logs-from-journald-wih-logstash-and-the-journald-plugin/58939/4 "2017-07-06T04:41:08Z")

</div>