Logstash Uknown error while parsing user agent data -->how to debug further?

Elastic Stack Logstash
1

I have a agent string from apache like:

" Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"

and it seems to fail as I see a lot of
[2019-06-17T16:40:49,679][ERROR][logstash.filters.useragent] Uknown error while parsing user agent data {:exception=>#<TypeError: cannot convert instance of class org.jruby.RubyHash to class java.lang.String>, :field=>"agent", :event=>#<LogStash::Event:0x4fa41c9c>}

Can I somehow debug this further? I've tested the grok filter with https://grokdebug.herokuapp.com/ and it works as expected, the only issues is with

  useragent {
      source => "agent"
    }
2

That suggests to me that the [agent] field is a hash rather than a string.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.