Logstash Parsing error

Elastic Stack Elasticsearch
1

Hi

Im getting below error while indexing to Elasticsearch

[2022-04-15T17:10:23,235][WARN ][logstash.outputs.Elasticsearch][events][e1ee9c29fd20ba0c5ba383dd438a2c18f56af21d370e65cce136d247cd14831b] Could not index event to Elasticsearch. {:status=>400, :action=>["update", {:_id=>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", :_index=>"dashboard_write", :routing=>nil, :_type=>"_doc", :retry_on_conflict=>1}, #LogStash::Event:0x4d94f793], :response=>{"update"=>{"_index"=>"dashboard-000086", "_type"=>"_doc", "_id"=>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to execute script", "caused_by"=>{"type"=>"script_exception", "reason"=>"runtime error", "script_stack"=>["ctx._source.appdata.add(params.event.get('appdata'))", " ^---- HERE"], "script"=>"if(ctx._source.appdata== null) ...", "lang"=>"painless", "position"=>{"offset"=>212, "start"=>176, "end"=>228}, "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"dynamic method [java.util.LinkedHashMap, add/1] not found"}}}}}}

In my filter I have below

  add_field => { "[appdata][accessType]" => "idp_app" }
            add_field => { "[appdata][appName]" => "%{S}" }
            add_field => { "[appdata][eventTime]" => "%{timestamp}" }

and my ouput has

 elasticsearch
            {
               hosts => ["localhost:9200"]
               document_id => "%{sid}"
               index =>  "dashboard_write"
       
                script => "if(ctx._source.appdata== null)
                         {
                           ctx._source.appdata = new ArrayList(); 
                        } 
                        ctx._source.appdata.add(params.event.get('appdata'))"
              doc_as_upsert => "true"

               action => "update"
			   ilm_enabled => false
            }

Field type of appdata is nested.

2

Can someone please provide input?

3

Can some one update please? We are getting this error every single time

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.