# Logstash cannot accept the events

**URL:** <https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646>\
**Category:** Logstash\
**Created:** [July 11, 2018, 11:18pm UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646 "2018-07-11T23:18:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![a\_zentavr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_zentavr/32/23534_2.png) [@a\_zentavr](https://discuss.elastic.co/u/a_zentavr)\
**Post date:** [July 11, 2018, 11:18pm UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646/1 "2018-07-11T23:18:05Z")

</div>

Since some time logstash cannot accept the events from other hosts. It just fills the disk with logs of:  
[2018-07-12T01:14:05,241][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"filebeat-2018.07.11", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x48a8f43], :response=\>{"index"=\>{"\_index"=\>"filebeat-2018.07.11", "\_type"=\>"doc", "\_id"=\>"RXGfi2QB4MOEB4eqhmGr", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for [host] tried to parse field [host] as object, but found a concrete value"}}}}

What could be the reason?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2018, 9:18am UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646/2 "2018-07-12T09:18:44Z")

</div>

Known problem with 6.3 of the Elastic stack. Search for "object mapping for [host] tried to parse field [host] as object, but found a concrete value" in the archives for details.

---

<div class="post-metadata">

**Author:** ![a\_zentavr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_zentavr/32/23534_2.png) [@a\_zentavr](https://discuss.elastic.co/u/a_zentavr)\
**Post date:** [July 12, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646/3 "2018-07-12T14:12:47Z")

</div>

I guess the problem appeared since we added a new node and installed 6.3.x version of filebeat.  
Yesterday I upgraded all the filebeats in the infrastructure, but the problem is still there.

I found a topic of [Problem with transfer Filebeat 6.1.3 \> Logstash 6.1.3 \> Elasticsearch 6.1.3](https://discuss.elastic.co/t/problem-with-transfer-filebeat-6-1-3-logstash-6-1-3-elasticsearch-6-1-3/136264/5). There they recommend to mutate the fields in order to pass into the new index schema.

---

<div class="post-metadata">

**Author:** ![a\_zentavr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_zentavr/32/23534_2.png) [@a\_zentavr](https://discuss.elastic.co/u/a_zentavr)\
**Post date:** [July 12, 2018, 2:53pm UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646/4 "2018-07-12T14:53:21Z")

</div>

[The recomendations what to do.](https://www.elastic.co/guide/en/beats/libbeat/6.3/breaking-changes-6.3.html#breaking-changes-mapping-conflict)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2018, 3:03pm UTC](https://discuss.elastic.co/t/logstash-cannot-accept-the-events/139646/5 "2018-08-09T15:03:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.