Logstash failed to parse field [host] of type [text] in document

Elastic Stack Logstash
1

[2023-09-10T19:02:57,621][WARN ][logstash.outputs.amazonelasticsearch][main][58792cc6d6e46359a72de39af72a6b76e760ccb0beb773f15a78ec2ef0b24671] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"5fb0e30921ec16ec2dec177a4098e5d23077d60b", :_index=>"jwt-authorizer-2023.09.10", :_type=>"_doc", :_routing=>nil}, #LogStash::Event:0x51d240fa], :response=>{"index"=>{"_index"=>"**********-2023.09.10", "_type"=>"_doc", "_id"=>"5fb0e30921ec16ec2dec177a4098e5d23077d60b", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id '5fb0e30921ec16ec2dec177a4098e5d23077d60b'. Preview of field's value: '{name=logstash-logstash-service-nllwl}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:9"}}}}}

Could you please help me?

2

{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in

On Kibana side you have field which don't match by type which you are sending from LS to Kib.
The most likely the host field is JSON object and you have the text field in Kibana.
You have to:

  • have the same types field
  • do reindex or delete or create a new index with different name
  • delete mapping and create again
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.