Since some time logstash cannot accept the events from other hosts. It just fills the disk with logs of: [2018-07-12T01:14:05,241][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-2018.07.11", :_type=>"do…

Logstash cannot accept the events

a_zentavr (Andrey Miroshnichenko) July 12, 2018, 2:12pm 3

I guess the problem appeared since we added a new node and installed 6.3.x version of filebeat.
Yesterday I upgraded all the filebeats in the infrastructure, but the problem is still there.

I found a topic of Problem with transfer Filebeat 6.1.3 > Logstash 6.1.3 > Elasticsearch 6.1.3. There they recommend to mutate the fields in order to pass into the new index schema.

Topic		Replies	Views
Logstash does not index event to elastic due to issue on host field Logstash	6	523	January 8, 2021
Could not index event to Elasticsearch 400 Logstash	3	967	May 21, 2019
Problem with transfer Filebeat 6.1.3 > Logstash 6.1.3 > Elasticsearch 6.1.3 Logstash	9	14460	August 17, 2018
[logstash.outputsCould not index event to Elasticsearch."error {"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [host] tried to parse field [host] as object, but found a concrete value" Logstash	4	1146	February 9, 2022
Could Not Index Event to Elasticsearch Error? Elasticsearch	8	38800	December 4, 2017

Logstash cannot accept the events

Related topics