# Mapper\_parsing\_exception", "reason"=\>"failed to parse \[severity\]" **URL:** \ **Category:** Logstash\ **Created:** [April 20, 2018, 12:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781 "2018-04-20T00:55:31Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![hobakill](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hobakill/32/18682_2.png) [@hobakill](https://discuss.elastic.co/u/hobakill)\ **Post date:** [April 20, 2018, 12:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/1 "2018-04-20T00:55:31Z")
full error: ``` [2018-04-20T00:33:26,274][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.04.20-ea1", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=> . {"_index"=>"logstash-2018.04.20-ea1", "_type"=>"doc", "_id"=>"KZJ44GIBORYB4ebWWD38", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [severity]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"INFO\""}}}}} ``` my `logstash-plain.log` is exploding with this error hundreds of times per minute. I'm curious if someone could point me in the right direction on how to troubleshoot this issue. I'm on ELK `6.2`Preformatted text ---
**Author:** ![Paulo\_Sergio\_Amaral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo_sergio_amaral/32/30208_2.png) [@Paulo\_Sergio\_Amaral](https://discuss.elastic.co/u/Paulo_Sergio_Amaral)\ **Post date:** [April 20, 2018, 3:37am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/2 "2018-04-20T03:37:39Z")
I have the same Problem, but in another field: `[2018-04-20T03:36:57,778][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.04.20", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"logstash-2018.04.20", "_type"=>"doc", "_id"=>"g6Ig4WIBqfBa_dd2Xqus", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [source] tried to parse field [source] as object, but found a concrete value"}}}}` I'm on ELK 6.2 too ---
**Author:** ![Paulo\_Sergio\_Amaral](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo_sergio_amaral/32/30208_2.png) [@Paulo\_Sergio\_Amaral](https://discuss.elastic.co/u/Paulo_Sergio_Amaral)\ **Post date:** [April 20, 2018, 6:04am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/3 "2018-04-20T06:04:55Z")
In my case, I just deleted the current index to solve error. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/eead02b06cc7b49ad4057b81142c58898b9441c2.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 20, 2018, 7:03am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/4 "2018-04-20T07:03:44Z")
How has the `severity` field been mapped in the ES index? Use ES's get mapping API to find out. ---
**Author:** ![hobakill](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hobakill/32/18682_2.png) [@hobakill](https://discuss.elastic.co/u/hobakill)\ **Post date:** [April 20, 2018, 12:32pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/5 "2018-04-20T12:32:28Z")
Thanks for the replies gentlemen: @magnusbaeck: ``` "severity":{"type":"long"},"severity_label":{"type":"text","norms":false,"fields":{"keyword": {"type":"keyword","ignore_above":256}}}, ``` a basic `curl` resulted in the above ^ interestingly: `➜ curl ${ESEA1}/logstash-2018.04.19-ea1/_mapping/severity` didn't quite work i had to `curl` the whole `mapping` endpoint and grep for `severity`. adding to this in my `/usr/share/logstash/patterns` the only reference to `severity` is here: ``` ############################## cassandra ############################################ CASSANDRA %{SYSLOG5424PRI}%{CISCOTIMESTAMP} %{DATA:HOSTNAME} cassandra_chum-log % . {DATA:severity} %{DATA} Compacted %{NUMBER:sstables:int} sstables to \[%{DATA:data_file}\]. % . {NUMBER:start_bytes:int} bytes to %{NUMBER:end_bytes:int} \(~%{NUMBER:percentage:int}\% of original\) in %{NUMBER:duration_int}ms = %{NUMBER:mb_sec:int}MB/s. % . {NUMBER:start_partitions:int} total partitions merged to %{NUMBER:end_partitions:int}. Partition merge counts were %{GREEDYDATA:merge_counts} ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 20, 2018, 2:54pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/6 "2018-04-20T14:54:55Z")
Okay, so for some reason `severity` had been mapped as an integer. You clearly can't store a string like "INFO" there. Decide which data type you want the field to be and reindex the data accordingly. ---
**Author:** ![hobakill](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hobakill/32/18682_2.png) [@hobakill](https://discuss.elastic.co/u/hobakill)\ **Post date:** [April 20, 2018, 3:15pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/7 "2018-04-20T15:15:20Z")
@magnusbaeck Don't know how to do that precisely. Any hints or links? The ELK stack was dropped into my lap and I'm kind of flying blind a bit. Thanks! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 23, 2018, 7:23am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/8 "2018-04-23T07:23:43Z")
What data type should `severity` be, an integer or a string? Did you at some point store a document where `severity` was an integer? Was that intentional? Do you still have a need to index documents with an integer `severity` field? ---
**Author:** ![hobakill](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hobakill/32/18682_2.png) [@hobakill](https://discuss.elastic.co/u/hobakill)\ **Post date:** [April 23, 2018, 12:36pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/9 "2018-04-23T12:36:27Z")
Thanks for the reply. I cannot imagine it was ever an integer. That being said we are decommissioning our Cassandra ring this week so this is likely a non-issue going forward. I appreciate the help from the community. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 23, 2018, 1:03pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/10 "2018-04-23T13:03:55Z")
If you can delete the index and start from scratch things should sort out just fine, but otherwise you'll have to - set up an index template (modify the one that ships with Logstash) to map the `severity` field as a string, - reindex the data, for example by copying the index contents to a temporary index (use ES's reindex API) and then copying it back. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2018, 1:03pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-failed-to-parse-severity/128781/11 "2018-05-21T13:03:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.