# Mapper\_parsing\_exception", "reason"=\>"object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value"}}}} **URL:** \ **Category:** Logstash\ **Created:** [September 27, 2023, 3:07pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000 "2023-09-27T15:07:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [September 27, 2023, 3:07pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000/1 "2023-09-27T15:07:25Z")
Please suggest me if there is a work around. ```auto [2023-09-27T14:56:22,072][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}[2023-09-27T14:56:22,094][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}[2023-09-27T14:57:04,252][WARN][logstash.outputs.opensearch][main][e88d14ed9d066b8862ff8822a615df883a8bf8bbb6c29a8ac8b57886c0a9c6a9] Could not index event to OpenSearch.{:status=>400, :action=>["index", {:_id=>"%{fingerprint}", :_index=>"abb-abo-abb1-xlm-2023.09.27", :routing=>nil}, {"HostIp"=>["10.10.188.18", "10.10.188.18", "10.10.188.18"], "message"=>"[140206525253504] 09/27/2023 14:57:03 [E] OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. Peer: 10.10.188.18:11890","ActualMsg"=>["OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. Peer: 10.10.188.18:11890", "OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. ", "OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. Peer: 10.10.188.18:11890", "OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. ", "OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. "], "Port"=>["11890", "11890", "11890"], "type"=>"abbmq", "aboach"=>["140206525253504", "140206525253504"], "event"=>{"hash"=>"f1bdbaaa1a05e04bf486856cf41e796d63d4d5d4", "original"=>"[140206525253504] 09/27/2023 14:57:03 [E] OpenSSL Error: error:140780E5:SSL routines:ssl23_read:ssl handshake failure. Peer: 10.10.188.18:11890"}, "partition"=>"abb1", "@version"=>"1", "podName"=>"abb","tags"=>["_dateparsefailure"], "@timestamp"=>2023-09-27T14:57:04.119983481Z, "log"=>{"file"=>{"path"=>"/var/abb/abbmq/logs/abbmq.log"}}, "host"=>"[host][name]", "nodeRole"=>"abb-abo-abb1-xlm", "productCode"=>"abb-abo", "loglevel"=>["E", "E"]}], :response=>{"index"=>{"_index"=>"abb-abo-abb1-xlm-2023.09.27", "_id"=>"%{fingerprint}", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [host] tried to parse field [host] as object, but found a concrete value"}}}} ``` Below is my grok ```auto input { file { path => "/var/abb/abbmq/logs/abbmq.log" start_position => "beginning" type => "abbmq" } } filter { if [type] == "abbmq"{ grok { match => {"message" => "^\[%{INT:Epoach}\]%{SPACE}%{DATE_US:LogTimestamp}%{SPACE}%{HOUR:hr}:%{MINUTE:min}:%{SECOND:sec} \[%{WORD:loglevel}\]%{SPACE}%{GREEDYDATA:ActualMsg}"} } if [ActualMsg] { grok { # Get fields from actualMsg match => {"ActualMsg" => "^%{GREEDYDATA:ActualMsg}\Peer.%{SPACE}%{IP:HostIp}\:%{INT:Port}"} } date { locale => "en" match => ["LogTimestamp", "dd/MMM/yyyy:HH:mm:ss Z"] timezone => "UTC" target => "@timestamp" } mutate { remove_field => ["LogTimestamp"] } mutate { remove_field => ["hr", "min", "sec"] } } } } ``` I tried to add the below mutate { replace =\> { "[host]" =\> "[host][name]" } } but still as issue. I appreciate your help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2023, 3:07pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000/2 "2023-09-27T15:07:26Z")
OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance. (This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: ) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 27, 2023, 3:34pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000/3 "2023-09-27T15:34:34Z")
Hi @ranjini It looks like you are connecting to OpenSearch not Elasticsearch so you should really go to their forums, you will not get much help here. Also your logsstash is wrong you can see `"host"=>"[host][name]",` this in the error replace is not correct you want to use rename ```auto mutate { rename => {"shortHostname" => "hostname"} } ``` And if you want to understand the error you can take a look at this > [@Logstash Parser error - tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140/4): > > Try this test, hopefully this makes it clearer POST test/\_doc { "myfield" : "myvalue", "myotherfield" : { "mysubfield1" : "mysubvalue1", "mysubfield2" : "mysubvalue2" } } Then Post POST test/\_doc { "myfield" : "myvalue", "myotherfield" : "myconcretevalue" } and you will get this error. { "error" : { "root\_cause" : [{ "type" : "mapper\_parsing\_exception", "reason" : "object mapping for [myotherfield] tried to parse field [myotherfield] as objec… ---
**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Post date:** [September 28, 2023, 12:27pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000/4 "2023-09-28T12:27:48Z")
Thank you @stephenb for helping. Appreciate your help. I removed the host field. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 26, 2023, 12:28pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/344000/5 "2023-10-26T12:28:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.