Hello,
I've been trying for 1-2 days to figure out why to create new fields when the type of the event is object but I cant seem to make it work..
This is the error im getting:
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"uat-gitlab-2021.32", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x323c63bd>], :response=>{"index"=>{"_index"=>"uat-gitlab-2021.32", "_type"=>"_doc", "_id"=>"KsvhxXsBdDJn5u6LtA8n", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [body.json.params.value] of type [text] in document with id 'KsvhxXsBdDJn5u6LtA8n'. Preview of field's value: '{features={vault_secrets=[FILTERED], return_exit_code=null, image=null, shared=null, variables=[FILTERED], cache=null, masking=null, cancelable=null, session=null, trace_reset=[FILTERED], terminal=null, services=null, multi_build_steps=null, upload_multiple_artifacts=null, raw_variables=[FILTERED], trace_checksum=[FILTERED], proxy=null, refspecs=null, upload_raw_artifacts=null, artifacts_exclude=null, trace_size=[FILTERED], artifacts=null}, shell=bash, executor=docker+machine, name=gitlab-runner, version=14.0.0, config={gpus=}, platform=linux, architecture=amd64, revision=3b6f852e}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:5253"}}}}}
For logstash conf i tried:
1.
ruby {
code => '
case event.get("[body][json][params][value]")
when !String
event.set("[body.json.params.valueObj]", event.get("[body][json][params][value]"))
event.remove("[body][json][params][value]")
end
'
if [body][json][params][value] =~ /^{.*}/ {
mutate { rename => { "[body][json][params][value]" => "[body][json][params][valueObj] "}
}
if [body][json][params][value] =~ /^{.*}/ {
json {
source => "[body][json][params][value]"
target => "[body][json][params][valueObj]"
skip_on_invalid_json => false
}
}
Nothings seems to work and troubleshooting it is not easy. I'd truly appreciate any help..
Best regards,
Tony