Mapper parsing exception - [variables.variable] tried to parse field [variable] as object, but found a concrete value

[jeisonsj (Jeison S Junqueira)]

Hi guys,

I'm facing an error only when using lowercase word "variables" for parsing a JSON event, that comes from Kafka, in a Filter clause.

I tested using the uppercase and no errors occurs. But I would like to understand why is that, because I didn't find anything stating that there is reserved words for the Logstash Filter or anything like that. Could anyone help me on this?

The Json input for Kafka message looks like this:

{
"requestId": 32132134,
"product": "limite",
"cpf": "01234567890",
"birthDate": "1990-10-10",
"email": "teste@teste.com",
"name": "Anyname",
"result": "IMARESULT",
"policy": {
"code": "blas",
"sentence": "bla,bla,bla"
},
"variables": [
{
"variable": "VAR_X",
"value": "99"
},
{
"variable": "VAR_Y",
"value": "IMAVALUE"
}
]
}

My Filter clause is this:

filter {
json {
source => "message"
}
}

The error output in logstash-plain.log is this:

[2018-11-12T12:49:22,113][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"kfk_topic", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x50ae0ddf], :response=>{"index"=>{"_index"=>"kfk_topic", "_type"=>"doc", "_id"=>"bI9mCGcB5Vo6-CLIAdC8", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [variables.variable] tried to parse field [variable] as object, but found a concrete value"}}}}

Regards,
Jeison.