Logstash crashes when converting fields to ECS Format

In more recent version you get a different error message

[ERROR] 2019-01-22 17:40:57.190 [Ruby-0-Thread-4: :1] pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"Could not set field 'file' on object 'bar' to value 'foo'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string", "backtrace"=>["org.logstash.Accessors.setChild(Accessors.java:120)"

Either way, I would not expect it to work. "destination" is a string and you are trying to make it an object.

3 Likes