Hi,
In logstash 5, when we had a "Could not index event to Elasticsearch", logstash logged the event with the message that caused the exception.
Ex:
[2019-04-08T14:47:58,939][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"indexZZZ", :_type=>"typeL", :_routing=>nil}, 2019-04-08T14:47:52.100Z SERVERX {"EventSeverity":"Verbose" ....}], :response=>{"index"=>{"_index"=>"indexZZZ", "_type"=>"typeL", "_id"=>"sdfsdfsdfsdf", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [field] of different type, current_type [long], merged_type [text]"}}}}
The messaged tried to insert in elasticsearch was "2019-04-08T14:47:52.100Z SERVERX {"EventSeverity":"Verbose" ....}"
In logstash 6, the same errors are logging in the following way:
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"indexAAA", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x70f59e7f], :response=>{"index"=>{"_index"=>"indexAAA", "_type"=>"doc", "_id"=>"tmBE_WkBDnuvom78Msig", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [field]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: "aaaaaaa""}}}}}
The log message cannot be retrieve from the log, it's "#LogStash::Event:0x70f59e7f". is it possible to force logstash to log the message? How?
Best Regards,
Filipe Ferreira.