Logstash template creation problem: parsing

Elastic Stack Elasticsearch
1

curl -XPUT http://localhost:9200/_template/logstash_per_index -d '{

"template": "logstash*",
"settings": {
"index.query.default_field": "@message",
"index.cache.field.type": "soft",
"index.store.compress.stored": true
},
"mappings": {
"default": {
"_all": { "enabled": false },
"properties": {
"@message": { "type": "string", "index": "analyzed" },
"@source": { "type": "string", "index": "not_analyzed" },
"@source_host": { "type": "string", "index": "not_analyzed" },
"@source_path": { "type": "string", "index": "not_analyzed" },
"@tags": { "type": "string", "index": "not_analyzed" },
"@timestamp": { "type": "string", "index": "not_analyzed" },
"@type": { "type": "string", "index": "not_analyzed" },
},
}
}
}
'
{"error":"ElasticSearchIllegalArgumentException[failed to parse template
source]; nested: JsonParseException[Unexpected character ('}' (code 125)):
was expecting either valid name character (for unquoted name) or
double-quote (for quoted) to start field name\n at [Source: [B@6594ed01; line: 19, column: 8]]; ","status":400}

What am I missing? Line 19 is a closing brace. Everything looks correct.
Any ideas?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Some comma signs at the end should not be here I guess.

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 30 oct. 2013 à 20:45, tom rkba tomrkba@gmail.com a écrit :

curl -XPUT http://localhost:9200/_template/logstash_per_index -d '{

"template": "logstash*",
"settings": {
"index.query.default_field": "@message",
"index.cache.field.type": "soft",
"index.store.compress.stored": true
},
"mappings": {
"default": {
"_all": { "enabled": false },
"properties": {
"@message": { "type": "string", "index": "analyzed" },
"@source": { "type": "string", "index": "not_analyzed" },
"@source_host": { "type": "string", "index": "not_analyzed" },
"@source_path": { "type": "string", "index": "not_analyzed" },
"@tags": { "type": "string", "index": "not_analyzed" },
"@timestamp": { "type": "string", "index": "not_analyzed" },
"@type": { "type": "string", "index": "not_analyzed" },
},
}
}
}
'
{"error":"ElasticSearchIllegalArgumentException[failed to parse template source]; nested: JsonParseException[Unexpected character ('}' (code 125)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: [B@6594ed01; line: 19, column: 8]]; ","status":400}

What am I missing? Line 19 is a closing brace. Everything looks correct. Any ideas?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

SOLUTION: remove two commas

curl -XPUT http://localhost:9200/_template/logstash_per_index -d '{
"template": "logstash*",
"settings": {
"index.query.default_field": "@message",
"index.cache.field.type": "soft",
"index.store.compress.stored": true
},
"mappings": {
"default": {
"_all": { "enabled": false },
"properties": {
"@message": { "type": "string", "index": "analyzed" },
"@source": { "type": "string", "index": "not_analyzed" },
"@source_host": { "type": "string", "index": "not_analyzed" },
"@source_path": { "type": "string", "index": "not_analyzed" },
"@tags": { "type": "string", "index": "not_analyzed" },
"@timestamp": { "type": "string", "index": "not_analyzed" },
"@type": { "type": "string", "index": "not_analyzed" }
}
}
}
}
'

Remove the comma at the end of any line that ends with } and has no other
items after it.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.