Hi
Im getting below error while indexing to Elasticsearch
[2022-04-15T17:10:23,235][WARN ][logstash.outputs.Elasticsearch][events][e1ee9c29fd20ba0c5ba383dd438a2c18f56af21d370e65cce136d247cd14831b] Could not index event to Elasticsearch. {:status=>400, :action=>["update", {:_id=>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", :_index=>"dashboard_write", :routing=>nil, :_type=>"_doc", :retry_on_conflict=>1}, #LogStash::Event:0x4d94f793], :response=>{"update"=>{"_index"=>"dashboard-000086", "_type"=>"_doc", "_id"=>"69f70c3491b563a0d0f89c8e2f58346d8d17db92c40a42b0d163fba1d008678c", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to execute script", "caused_by"=>{"type"=>"script_exception", "reason"=>"runtime error", "script_stack"=>["ctx._source.appdata.add(params.event.get('appdata'))", " ^---- HERE"], "script"=>"if(ctx._source.appdata== null) ...", "lang"=>"painless", "position"=>{"offset"=>212, "start"=>176, "end"=>228}, "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"dynamic method [java.util.LinkedHashMap, add/1] not found"}}}}}}
In my filter I have below
add_field => { "[appdata][accessType]" => "idp_app" }
add_field => { "[appdata][appName]" => "%{S}" }
add_field => { "[appdata][eventTime]" => "%{timestamp}" }
and my ouput has
elasticsearch
{
hosts => ["localhost:9200"]
document_id => "%{sid}"
index => "dashboard_write"
script => "if(ctx._source.appdata== null)
{
ctx._source.appdata = new ArrayList();
}
ctx._source.appdata.add(params.event.get('appdata'))"
doc_as_upsert => "true"
action => "update"
ilm_enabled => false
}
Field type of appdata is nested.