Hello,
I have a field named "Income Bracket" that has values like
"$50,000 - $100,000",
"$50,000 and under",
"$100,000 - $500,000" etc.
I am trying to load the doc with this field and couple of others using logstash however unable to load due to the following error:
[2019-02-19T16:26:56,979][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"verbatims_index", :_type=>"verbatim", :routing=>nil}, #LogStash::Event:0x1538332c], :response=>{"index"=>{"_index"=>"verbatims_index", "_type"=>"verbatim", "_id"=>"JCanB2kBoGbYmP3flOO5", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [Income Bracket] of type [integer_range]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"error parsing field [Income Bracket], expected an object but got Income Bracket"}}}}}
Could anyone please help me out to resolve?
Config file looks like below:
</>
filter {
mutate {
convert => { "Income Bracket" => "string" }
gsub => ["Income Bracket","$",""]
}
}
Also the json template I am using is as below:
"Income Bracket": {
"type": "string",
"index" : "not_analyzed"
},