Logstash output Elasticsearch MapperParsingException[Field name [classes.loaded] cannot contain '.']

Hi

I am running the latest version of Logstash [5.02] Elasticsearch [5.0.2] and Kibana [5.0.2], I'm using the http_poller plugin in Logstash, nstalled it and got confirmation. I am trying to get spring actuator (metrics) from my webapp and index them into Elasticsearch. it works OK for health checks but when I try to get the metrics I get this error from elasticsearch.

MapperParsingException[Field name [classes.loaded] cannot contain '.']
        at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:283)
        at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:228)
        at org.elasticsearch.index.mapper.object.RootObjectMapper$TypeParser.parse(RootObjectMapper.java:137)
        at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:211)
        at org.elasticsearch.index.mapper.DocumentMapperParser.parseCompressed(DocumentMapperParser.java:192)
        at org.elasticsearch.index.mapper.MapperService.parse(MapperService.java:368)
        at org.elasticsearch.cluster.metadata.MetaDataMappingService$2.execute(MetaDataMappingService.java:382)
        at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:388)
        at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:225)
        at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:188)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

when I run logstash "type"=>"mapper_parsing_exception", "reason"=>"Field name [classes.loaded] cannot contain '.'" I get this error message after it shows the metric in json format.

{
                            "heap.committed" => 475136,
                            "threads.daemon" => 61,
                               "counter.mem" => 0,
                  "counter.classes.unloaded" => 0,
                "counter.systemload.average" => 0,
                                   "classes" => 14104,
                      "http_poller_metadata" => {
                 "request" => {
            "headers" => {
                "Accept" => "application/json"
            },
             "method" => "get",
               "auth" => {
                "pass" => "tester",
                "user" => "tester"
            },
                "url" => "http://localhost:8080/myappapi/details/metrics"
        },
        "response_headers" => {
                                 "date" => "Mon, 05 Dec 2016 12:15:11 GMT",
                               "server" => "Apache-Coyote/1.1",
                              "expires" => "0",
                    "transfer-encoding" => "chunked",
               "x-content-type-options" => "nosniff",
                     "x-xss-protection" => "1; mode=block",
                      "x-frame-options" => "DENY",
                         "content-type" => "application/json;charset=UTF-8",
                        "cache-control" => "no-cache, no-store, max-age=0, must-revalidate",
                "x-application-context" => "application:dev:8080",
                               "pragma" => "no-cache",
            "strict-transport-security" => "max-age=31536000 ; includeSubDomains"
        },
                    "code" => 200,
        "response_message" => "OK",
           "times_retried" => 0,
         "runtime_seconds" => 0.371,
                    "name" => "consumersmetrics",
                    "host" => "gman"
    },
                        "systemload.average" => -1.0,
        "counter.status.200.details.metrics" => 4,
                          "counter.mem.free" => 0,
}
12:15:12.725 [[main]>worker0] WARN  logstash.outputs.elasticsearch - Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2016.12.05", :_type=>"myappapi_health_details", :_routing=>nil}, 2016-12-05T12:15:11.919Z %{host} %{message}], :response=>{"create"=>{"_index"=>"logstash-2016.12.05", "_type"=>"myappapi_health_details", "_id"=>"AVjO6MtNqsQV7YsrAn8i", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field name [classes.loaded] cannot contain '.'"}}}}

Anyone know why..

Are you sure you're running ES 5.x and not 2.x? ES 5.0 should accept field names with periods, see https://www.elastic.co/guide/en/elasticsearch/reference/2.4/dots-in-names.html. See also Logstash's de_dot filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.