Object mapping error for common field name "error"

[true64gurus]

Hello,

I am getting the object mapping error. The logs are coming from Kubernetes cluster . On same index , the field "error" comes from App1 as json object , while comes as number from app2, comes as "one word string" from app3, and multiple words from app 4.

Looked at solutions on this forum and non of them worked.

• Renaming field moves the problem to new field name.
• Logstash doesn't provide a way to detect field type on pipeline.

Appreciate help

Thanks
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [error] tried to parse field [error] as object, but found a concrete value"}}}

[Badger]

Look at the last option in this post.

[Andrew_Mora]

@true64gurus

Hello,

I am getting the object mapping error. The logs are coming from Kubernetes cluster . On same index , the field "error" comes from App1 as json object , while comes as number from app2, comes as "one word string" from app3, and multiple words from app 4.

Looked at solutions on this forum and non of them worked.

• Renaming field moves the problem to new field name.
• Logstash doesn't provide a way to detect field type on pipeline.

Appreciate help

Thanks
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [error] tried to parse field [error] as object, but found a concrete value"}}}

It seems like quite a challenging situation. Have you tried using a Logstash filter to explicitly set the field type based on the source app to address this mapping issue? Wishing you luck in resolving it!

[true64gurus]

@Badger Since most of the logs are object , I am thinking to convert the logs with concrete values to objects instead of other way around .

When field "error" comes as object it usually comes as flat json.

How to convert the "concrete value" to object ?

Thanks

[Badger]

Do you know what the error objects look like? If you know the name of one of the fields within [error] then there are other solutions in the post I linked to.