### Author:  [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)
#### Post date: [February 27, 2020, 5:38pm UTC](https://discuss.elastic.co/t/logstash-exec-input/221295/1 "2020-02-27T17:38:16Z")
Hello,
I have a simple EXEC input in logstash, as follows:
input {
exec {
command =\> "ls"
interval =\> 30
}
}
output {
elasticsearch {
hosts =\> ["\:9200"]
}
}
However, I keep getting the following error in Logsatsh:
Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x7b6abf30], :response=\>{"index"=\>{"\_index"=\>"logstash-2019.12.10-000001", "\_type"=\>"\_doc", "\_id"=\>"p3i5h3ABrLJab5qrENsk", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for [host] tried to parse field [host] as object, but found a concrete value"}}}}
How does indexing work for the EXEC input plugin? Does it not simply put the results in the existing logstash index? Thank you!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 27, 2020, 6:11pm UTC](https://discuss.elastic.co/t/logstash-exec-input/221295/2 "2020-02-27T18:11:11Z")
An exec input [sets](https://github.com/logstash-plugins/logstash-input-exec/blob/master/lib/logstash/inputs/exec.rb#L84) the [host] field equal to the name of the server on which it executes (as does a file input and probably some others). However, beats add [host] as an object containing a [host][name] field. elasticsearch cannot support a field that is sometimes a string and sometimes an object.
You can use mutate+rename to change [host] to [host][name].
---
### Author:  [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)
#### Post date: [February 27, 2020, 6:44pm UTC](https://discuss.elastic.co/t/logstash-exec-input/221295/3 "2020-02-27T18:44:12Z")
Ah, I understand. Thank you, Badger, for the information. Could I bother you again to give me the syntax for adding the filter in my file? Thank you!
---
### Author:  [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)
#### Post date: [February 27, 2020, 7:00pm UTC](https://discuss.elastic.co/t/logstash-exec-input/221295/4 "2020-02-27T19:00:00Z")
Thank you so much, Badger! I got it to work, following your advice. I appreciate your time very much!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2020, 7:00pm UTC](https://discuss.elastic.co/t/logstash-exec-input/221295/5 "2020-03-26T19:00:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.