Logstash integration with elastic cloud

[Guddu_Prasad]

Hi Team,

I am getting below error message with logstash.

[2020-05-24T15:11:59,888][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"fmc", :routing=>nil, :_type=>"_doc"}, #LogStash::Event:0x64bcc3ba], :response=>{"index"=>{"_index"=>"fmc", "_type"=>"_doc", "_id"=>"BEI9R3IBNjQQbI4wm6b6", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [name] of type [text] in document with id 'BEI9R3IBNjQQbI4wm6b6'. Preview of field's value: '{data=ISE, blockLength=12, blockType=0}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:48"}}}}}

Thanks
Guddu

[warkolm (Mark Walkom)]

Welcome!

@Guddu_Prasad

Preview of field's value: '{data=ISE, blockLength=12, blockType=0}'

It's saying that the value of the name field is {data=ISE, blockLength=12, blockType=0}, which doesn't look right at all, and Elasticsearch attempts to translate that into an object instead of it being text.

You'd need to identify where that value is coming from

[Guddu_Prasad]

Thank you for your reply.