Hi, could help me with errors at the logstash
[2020-09-21T13:48:42,854][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"apimanager-2020.09.21", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x72287a20], :response=>{"index"=>{"_index"=>"apimanager-2020.09.21", "_type"=>"doc", "_id"=>"cWiRsXQBL24JsUDhSSch", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [source] of type [text]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:455"}}}}}
[2020-09-21T13:51:15,208][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"apimanager-2020.09.21", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x4048a020], :response=>{"index"=>{"_index"=>"apimanager-2020.09.21", "_type"=>"doc", "_id"=>"B2yTsXQBL24JsUDhmFek", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [kubernetes.labels.app] of type [text]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:851"}}}}}
I did the configuration at the logstash like this
input {
beats {
port => "5053"
}
}
filter {
mutate {
convert => {
"kubernetes.labels.app" => "string"
}
}
}
output {
elasticsearch {
hosts => ["elk1:9200"]
index => "apimanager-%{+YYYY.MM.dd}"
}
}