Logstash Parser error - tried to parse field as object, but found a concrete value

Elastic Stack Logstash
4

Try this test, hopefully this makes it clearer

POST test/_doc
{
  "myfield" : "myvalue",
  "myotherfield" :
  {
    "mysubfield1" : "mysubvalue1",
    "mysubfield2" : "mysubvalue2"
  }
}

Then Post

POST test/_doc
{
  "myfield" : "myvalue",
  "myotherfield" : "myconcretevalue"
}

and you will get this error.

{
  "error" : {
    "root_cause" : [
      {
        "type" : "mapper_parsing_exception",
        "reason" : "object mapping for [myotherfield] tried to parse field [myotherfield] as object, but found a concrete value"
      }
    ],
    "type" : "mapper_parsing_exception",
    "reason" : "object mapping for [myotherfield] tried to parse field [myotherfield] as object, but found a concrete value"
  },
  "status" : 400
}

This is because the first document created a mapping where myotherfield is an object ...

You can see the mapping by running

GET /test/

then when you try to post a document that has myotherfield as a simple concrete field/ data type it throws an error , that field can not be both types.

The mapping (schema) is static for each field

Either a field is and object or a simple data type or and array etc ... once the type is defined that type is "static" not "dynamic". All documents to be indexed need to adhere to the mapping. You either need to put it in a different field or not index that document.

You can clean that up and do it it the opposite order... then the type will be a simple field (keyword and text) then if you try to add the doc with the sub object it will complain with a different error.

Once the mapping is defined for a field... the data type is static.

So in your case you have logs coming in where some fields get defined as an object and some logs where that same field is a simple concrete value... you need to figure out which and solve for it.

3 Likes