Since some time logstash cannot accept the events from other hosts. It just fills the disk with logs of: [2018-07-12T01:14:05,241][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-2018.07.11", :_type=>"do…

Logstash cannot accept the events

a_zentavr (Andrey Miroshnichenko) July 12, 2018, 2:12pm 3

I guess the problem appeared since we added a new node and installed 6.3.x version of filebeat.
Yesterday I upgraded all the filebeats in the infrastructure, but the problem is still there.

I found a topic of Problem with transfer Filebeat 6.1.3 > Logstash 6.1.3 > Elasticsearch 6.1.3. There they recommend to mutate the fields in order to pass into the new index schema.

Topic		Replies	Views
Logstash does not index event to elastic due to issue on host field Logstash	6	516	January 8, 2021
[logstash.outputsCould not index event to Elasticsearch."error {"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [host] tried to parse field [host] as object, but found a concrete value" Logstash	4	1134	February 9, 2022
Could Not Index Event to Elasticsearch Error? Elasticsearch	8	38765	December 4, 2017
Failed to parse the field Elasticsearch	2	698	October 26, 2020
Could not index event to Elasticsearch. - failed to parse [host] Logstash	5	1243	October 9, 2018

Logstash cannot accept the events

Related Topics