# Logstash \_split\_type\_failure
**URL:** https://discuss.elastic.co/t/logstash-split-type-failure/216018
**Category:** Logstash
**Created:** [January 22, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018 "2020-01-22T09:29:46Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@ramypala](https://discuss.elastic.co/u/ramypala)
#### Post date: [January 22, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/1 "2020-01-22T09:29:46Z")
## My Raw Data
{"records":[{"parent":"","made\_sla":"true","caused\_by":"","watch\_list":"","upon\_reject":"cancel","sys\_updated\_on":"2020-01-22 05:47:33","child\_incidents":"0","u\_incident\_age\_in\_days":"1970-07-21 00:13:56","hold\_reason":"","approval\_history":"","skills":"","number":"INC0011015","resolved\_by":"6816f79cc0a8016401c5a33be04be441","sys\_updated\_by":"admin","opened\_by":"6816f79cc0a8016401c5a33be04be441","user\_input":""},{"parent":"","made\_sla":"true","caused\_by":"","watch\_list":"","upon\_reject":"cancel","sys\_updated\_on":"2020-01-22 05:47:33","child\_incidents":"0","u\_incident\_age\_in\_days":"1970-07-21 00:16:40","hold\_reason":"","approval\_history":"","skills":"","number":"INC0010021","resolved\_by":"6816f79cc0a8016401c5a33be04be441","sys\_updated\_by":"admin","opened\_by":"6816f79cc0a8016401c5a33be04be441","user\_input":""}]
## My config file
input {
http\_poller {
urls =\> {
url =\> "[https://dev63285.service-now.com/incident\_list.do?JSONv2&display\_value=True&sysparm\_exclude\_reference\_link=True&sysparm\_fields=number%2Cstate%2Copened\_at%2Cclosed\_at%2Cpriority%2Cassigned\_to%2Cassignment\_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm\_limit=1sysparm\_view=json\_view](https://dev63285.service-now.com/incident_list.do?JSONv2&display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Cstate%2Copened_at%2Cclosed_at%2Cpriority%2Cassigned_to%2Cassignment_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm_limit=1sysparm_view=json_view)"
}
request\_timeout =\> 60
proxy =\> { host =\> "10.88.129.144" port =\> "80" scheme =\> "http"}
user =\> "admin"
password =\> "Snow2020\*"
schedule =\> { cron =\> "\* \* \* \* \*"}
codec =\> "json"
metadata\_target =\> "http\_poller\_metadata"
}
}
filter
{
split {
field =\> "records"
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "servicenowinc"
}
stdout {
codec =\> rubydebug
}
}
Getting below error when I run the config file.Please help.
"Only String and Array types are splittable. field:records is of type = NilClass"
C:/Elastic\_Stack/logstash-7.5.1/vendor/bundle/jruby/2.5.0/gems/awesome\_print-1.7.0/lib/awesome\_print/formatters/base\_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"tags" =\> [
[0] "\_http\_request\_failure",
[1] "\_split\_type\_failure"
],
"http\_request\_failure" =\> {
"error" =\> "connect timed out",
"backtrace" =\> nil,
"runtime\_seconds" =\> 10.24,
"request" =\> {
"url" =\> "[https://dev63285.service-now.com/incident\_list.do?JSONv2&display\_value=True&sysparm\_exclude\_reference\_link=True&sysparm\_fields=number%2Cstate%2Copened\_at%2Cclosed\_at%2Cpriority%2Cassigned\_to%2Cassignment\_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm\_limit=1sysparm\_view=json\_view](https://dev63285.service-now.com/incident_list.do?JSONv2&display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Cstate%2Copened_at%2Cclosed_at%2Cpriority%2Cassigned_to%2Cassignment_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm_limit=1sysparm_view=json_view)",
"method" =\> "get"
},
"name" =\> "url"
},
"@timestamp" =\> 2020-01-22T09:27:10.596Z,
"@version" =\> "1",
"http\_poller\_metadata" =\> {
"host" =\> "DESKTOP-JRAAHA2",
"runtime\_seconds" =\> nil,
"request" =\> {
"url" =\> "[https://dev63285.service-now.com/incident\_list.do?JSONv2&display\_value=True&sysparm\_exclude\_reference\_link=True&sysparm\_fields=number%2Cstate%2Copened\_at%2Cclosed\_at%2Cpriority%2Cassigned\_to%2Cassignment\_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm\_limit=1sysparm\_view=json\_view](https://dev63285.service-now.com/incident_list.do?JSONv2&display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Cstate%2Copened_at%2Cclosed_at%2Cpriority%2Cassigned_to%2Cassignment_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm_limit=1sysparm_view=json_view)",
"method" =\> "get"
},
"name" =\> "url"
}
}
[2020-01-22T14:58:10,284][WARN][logstash.filters.split][main] Only String and Array types are splittable. field:records is of type = NilClass
{
"tags" =\> [
[0] "\_http\_request\_failure",
[1] "\_split\_type\_failure"
---
### Author:  [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [January 22, 2020, 11:07am UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/2 "2020-01-22T11:07:23Z")
Hi
You seem to have a problem in your `http_poller{}` input plugin. It doesn't generate any response, so your `records` field does not exist and that's why you get a `_split_type_failure` tag as well (only strings and arrays can be split).
Check your [`http_poller{}`](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html) syntax and parameters.
Does the url work if you paste it on your browser? or with curl/wget?
On a side note, do not post credentials on forums! (or anywhere else, for that matter).
Hope this helps.
---
### Author:  [@ramypala](https://discuss.elastic.co/u/ramypala)
#### Post date: [January 22, 2020, 11:10am UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/3 "2020-01-22T11:10:30Z")
Hi Jordi,
Yes I pasted the URL in browser and verified.It works and it had 3 tabs JSON,Raw Data,Headers.
Thanks,
Ramya
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/4 "2020-01-22T14:53:25Z")
If the request works in your browser then the problem is likely in the proxy.
---
### Author:  [@ramypala](https://discuss.elastic.co/u/ramypala)
#### Post date: [January 24, 2020, 3:59pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/5 "2020-01-24T15:59:40Z")
Thanks Badger.
I commented the proxy server ,username and password from my config file.
Now I am not getting http\_request\_failure.But getting \_split\_type\_failure.I have attached the raw data and config file in my first post.Kindly help.
Error:
[2020-01-24T21:21:02,411][WARN][logstash.filters.split][main] Only String and Array types are splittable. field:records is of type = NilClass
C:/Elastic\_Stack/logstash-7.5.1/vendor/bundle/jruby/2.5.0/gems/awesome\_print-1.7.0/lib/awesome\_print/formatters/base\_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"tags" =\> [
[0] "\_split\_type\_failure"
],
"@timestamp" =\> 2020-01-24T15:51:02.184Z,
"@version" =\> "1",
"http\_poller\_metadata" =\> {
"response\_message" =\> "Unauthorized",
"times\_retried" =\> 0,
"request" =\> {
"url" =\> "[https://dev63285.service-now.com/incident\_list.do?JSONv2&display\_value=True&sysparm\_exclude\_reference\_link=True&sysparm\_fields=number%2Cstate%2Copened\_at%2Cclosed\_at%2Cpriority%2Cassigned\_to%2Cassignment\_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm\_limit=1sysparm\_view=json\_view](https://dev63285.service-now.com/incident_list.do?JSONv2&display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Cstate%2Copened_at%2Cclosed_at%2Cpriority%2Cassigned_to%2Cassignment_group%2Cactive%2Cimpact%2Curgency%2Cseverity&sysparm_limit=1sysparm_view=json_view)",
"method" =\> "get"
},
"runtime\_seconds" =\> 2.02,
"host" =\> "DESKTOP-JRAAHA2",
"response\_headers" =\> {
"www-authenticate" =\> "BASIC realm="Service-now"",
"strict-transport-security" =\> "max-age=63072000; includeSubDomains",
"set-cookie" =\> [
[0] "JSESSIONID=7BF827C5956824780B96A30799C4C5EA; Path=/; HttpOnly;Secure",
[1] "BIGipServerpool\_dev63285=2424395786.35136.0000; path=/; Httponly; Secure"
],
"date" =\> "Fri, 24 Jan 2020 15:51:02 GMT",
"connection" =\> "close",
"content-length" =\> "0",
"server" =\> "ServiceNow"
},
"code" =\> 401,
"name" =\> "url"
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 24, 2020, 5:10pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/6 "2020-01-24T17:10:26Z")
There is no [records] field in that event, so it fails to split it.
---
### Author:  [@ramypala](https://discuss.elastic.co/u/ramypala)
#### Post date: [January 24, 2020, 5:36pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/7 "2020-01-24T17:36:06Z")
Hi Badger,
Thanks for the reply.Which field do I need to use instead of records to achieve the splitting.Can you please check my raw data and tell me?
Thanks and Regards,
Ramya
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 24, 2020, 6:12pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/8 "2020-01-24T18:12:32Z")
> [@ramypala](#):
>
> "response\_message" =\> "Unauthorized"
I do not think you are getting any records.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2020, 6:12pm UTC](https://discuss.elastic.co/t/logstash-split-type-failure/216018/9 "2020-02-21T18:12:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.