# Logstash Giving failed to parse \[Records.apiVersion\]

**URL:** <https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781>\
**Category:** Logstash\
**Created:** [November 15, 2018, 5:09am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781 "2018-11-15T05:09:34Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [November 15, 2018, 5:09am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/1 "2018-11-15T05:09:34Z")

</div>

Hi Team,

Great morning, Hope you are doing awesome.

I am trying to ship cloudtrail logs in my ELK. But I'm getting following warning

[WARN] 2018-11-14 23:45:37.775 [Ruby-0-Thread-6@[main]\>worker0: :1] elasticsearch - Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"cloudtrail-2018.11.15", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x52da2cb2], :response=\>{"index"=\>{"\_index"=\>"cloudtrail-2018.11.15", "\_type"=\>"doc", "\_id"=\>"LrWwFWcBV6thQHuuWGBp", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [Records.apiVersion]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2017\_10\_30" is malformed at "\_10\_30""}}}}}

Though logs are shipping in my kibana. but I saw a warning message on kibana UI: "Objects in arrays are not well supported"

My config file is as below :

input {  
s3 {  
bucket =\> "abc"  
prefix =\> "abcded/"  
region =\> "us-east-1"  
type =\> "cloudtrail"  
codec =\> json\_lines  
secret\_access\_key =\> "asdafafafas"  
access\_key\_id =\> "asdfsafsfsd"  
}  
}  
filter {  
if [type] == "cloudtrail" {  
geoip {  
source =\> "sourceIPAddress"  
target =\> "geoip"  
add\_tag =\> ["cloudtrail-geoip"]  
}  
}  
mutate {  
add\_field =\> { "indexname" =\> "cloudtrail-%{+YYYY.MM.dd}" }  
}  
mutate {  
lowercase =\> ["indexname"]  
}

```
mutate {
  gsub => [
    "eventSource", "\.amazonaws\.com$", "",
    "apiVersion", "_", "-"
  ]
}

```

}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "cloudtrail-%{+YYYY.MM.dd}"  
}  
}

Note : logstash.version"=\>"6.3.1  
elasticsearch version 6.3.2

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [November 29, 2018, 6:08am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/2 "2018-11-29T06:08:26Z")

</div>

Can anyone please help me out?

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 29, 2018, 8:28am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/3 "2018-11-29T08:28:20Z")

</div>

Does not look like your gsub is working correctly. Interestingly, the field in the error says "Records.apiVersion" but in your gsub you are accessing "apiVersion" is this correct??

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [November 29, 2018, 11:52am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/4 "2018-11-29T11:52:21Z")

</div>

Even using Records.apiVersion in gsub it giving the same error.  
Although apiVersion in gsub is correct way.

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 29, 2018, 12:10pm UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/5 "2018-11-29T12:10:51Z")

</div>

So what is the field name? Records.apiVersion or apiVersion?

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [November 30, 2018, 6:18am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/6 "2018-11-30T06:18:18Z")

</div>

apiVersion,

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [November 30, 2018, 6:19am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/7 "2018-11-30T06:19:26Z")

</div>

Now i'm getting these error as well .  
[WARN] 2018-11-30 01:10:28.502 [Ruby-0-Thread-9@[main]\>worker3: :1] elasticsearch - Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"cloudtrail-2018.11.30", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x4dd97c5], :response=\>{"index"=\>{"\_index"=\>"cloudtrail-2018.11.30", "\_type"=\>"doc", "\_id"=\>"iKM9Y2cB4Qlyba7XPFU2", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Rejecting mapping update to [cloudtrail-2018.11.30] as the final mapping would have more than 1 type: [apiVersion\_type, doc]"}}}}  
[WARN] 2018-11-30 01:10:28.502 [Ruby-0-Thread-9@[main]\>worker3: :1] elasticsearch - Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"cloudtrail-2018.11.30", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x5c6f18b5], :response=\>{"index"=\>{"\_index"=\>"cloudtrail-2018.11.30", "\_type"=\>"doc", "\_id"=\>"iaM9Y2cB4Qlyba7XPFU2", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [Records.apiVersion] of different type, current\_type [text], merged\_type [date]"}}}}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2018, 6:19am UTC](https://discuss.elastic.co/t/logstash-giving-failed-to-parse-records-apiversion/156781/8 "2018-12-28T06:19:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.