.*)"
}
}
}
}
output{
elasticsearch {
hosts => ["localhost:9200"]
index => "filteredindex"
}
}
```
But I still get the same error. I think it's just a mismatch in data and I can't get it to work. Does anyone know what's missing? Huge thanks ahead!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 18, 2020, 7:41pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/2 "2020-07-18T19:41:50Z")
I suggest you read [this](https://discuss.elastic.co/t/logstash-errors-mapper-parsing-exception-vs-illegal-argument-exception/236783/3) post and then [this](https://discuss.elastic.co/t/problem-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch-wazuh-alerts-3-x-2020-05-30/235038/6) post.
The beats input adds a [host] object to the event, the file input adds a [host] string to the event. A field cannot be an object on some documents and string on others. If you decide you want [host] to be an object you can do a mutate that is conditional upon [host] being a string. If you decide you want [host] to be a string then make the mutate conditional upon it being an object. Then once you start over with an empty index you should be OK.
---
### Author:  [@elk6](https://discuss.elastic.co/u/elk6)
#### Post date: [July 18, 2020, 8:13pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/3 "2020-07-18T20:13:02Z")
Thanks for the response!
I just want it to be a string, should it be:
```
if ! [host][name] {
mutate {
rename => { "[host]" => "[host][name]" }
convert => {"[host][name]" => "string"}
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 18, 2020, 8:40pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/4 "2020-07-18T20:40:51Z")
That should work.
---
### Author:  [@elk6](https://discuss.elastic.co/u/elk6)
#### Post date: [July 19, 2020, 8:02am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/5 "2020-07-19T08:02:06Z")
I still get the same issue ☹
```auto
[2020-07-19T07:57:16,280][WARN][logstash.outputs.elasticsearch][main][ceb2c9b33104bb3ec31e20cf77c2d606d772a42046d77552fcc187a7d376c102] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filteredindex", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"filteredindex", "_type"=>"_doc", "_id"=>"MTUTZnMBpYpmFLeevDJZ", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'MTUTZnMBpYpmFLeevDJZ'. Preview of field's value: '{hostname=server150, os={kernel=3.10.0-1062.18.1.el7.x86_64, codename=Core, name=CentOS Linux, family=redhat, version=7 (Core), platform=centos}, containerized=false, ip=[*public-ip*], name=server150, id=3eec437c66d444a59ef5f075a429441d, mac=[*mac*], architecture=x86_64}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:218"}}}}}
```
This is the config file I used:
```auto
input{
# file{
# path => "/var/log/commands.log"
# }
beats{
port => 5044
}
}
filter {
if ! [host][name] { mutate { rename => { "[host]" => "[host][name]" } convert => {"[host][name]" => "string"} } }
if [path] == "/var/log/commands.log" {
grok{
match => { "message" => "\[(%{TIMESTAMP_ISO8601:sys_timestamp})\]\s(?[0-9a-zA-Z_-]+)\s(?[0-9a-zA-Z_-]+)\:USER=(? ["localhost:9200"]
index => "filteredindex"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 19, 2020, 6:17pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/6 "2020-07-19T18:17:50Z")
The index expects [host] to be a string, but you are inserting documents where it is an object:
Preview of field's value: '{hostname=server150, os={kernel=3.10.0-1062.18.1.el7.x86\_64, codename=Core, name=CentOS Linux, family=redhat, version=7 (Core), platform=centos}, containerized=false, ip=[_public-ip_], name=server150, id=3eec437c66d444a59ef5f075a429441d, mac=[_mac_], architecture=x86\_64}'
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 16, 2020, 6:18pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-mismatch/241758/7 "2020-08-16T18:18:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.