Logstash Errors mapper_parsing_exception vs illegal_argument_exception

Elastic Stack Logstash
1

I am trying to understand the difference between these two errors:

[2020-06-05T13:51:34,267][WARN ][logstash.outputs.elasticsearch][filebeat] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-ilm-6.5.1", :routing=>nil, :_type=>"_doc"}, #LogStash::Event:0x7cd8e6f9], :response=>{"index"=>{"_index"=>"filebeat-ilm-6.5.1-2020.06.05-000006", "_type"=>"_doc", "_id"=>"bijAhHIB6QPGMv6USiAf", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [kubernetes.labels.app] tried to parse field [app] as object, but found a concrete value"}}}}

and this error:

{"level":"WARN","loggerName":"logstash.outputs.elasticsearch","timeMillis":1591902736087,"thread":"[filebeat]>worker1","logEvent":{"message":"Could not index event to Elasticsearch.","status":400,"action":["index",{"_index":"filebeat-ilm-6.5.1","_type":"_doc"},{"metaClass":{"metaClass":{"metaClass":{"action":"["index", {:_id=>nil, :_index=>"filebeat-ilm-6.5.1", :routing=>nil, :_type=>"_doc"}, #LogStash::Event:0x3b9ff5c7]","response":{"index":{"_index":"filebeat-ilm-6.5.1-2020.06.11-000015","_type":"_doc","id":"P9nMpHIBUCo_PZZ1DhC","status":400,"error":{"type":"illegal_argument_exception","reason":"mapper [logEvent.action] of different type, current_type [keyword], merged_type [ObjectMapper]"}}}}}}}]}}

The first one appears to be a mapper_parsing_exception as the 2nd is a illegal_argument_exception.

The first makes sense as we have had documents indexed with the field kubernetes.labels.app as a string, then on rollover a document was indexed with an object nested in the kubernetes.labels.app filed instead of a string causing the mapper parsing exception.

Why isn't the second error message a mapper_parsing_exception as it appears to be the same issue but with field logEvent.action?

1 Like
2

That's an interesting observation. Searching a bit reveals this - "illegal_argument_exception" for field starting or ending with a [.] · Issue #28890 · elastic/elasticsearch · GitHub

Perhaps in the second case your input argument itself is ambiguous as explained in that link above but the trace still points to a mapping error since that is what it resolves to eventually.

Seeing the actual field value that you are trying to index could reveal more.

1 Like
3

I believe the first exception indicates that in elasticsearch the field is an object, but you are trying to insert a string, and the second indicates that in elasticsearch the field is a string, but you are trying to insert an object.

3 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.