Object mapping error for common field name "error"

Elastic Stack Logstash
1

Hello,

I am getting the object mapping error. The logs are coming from Kubernetes cluster . On same index , the field "error" comes from App1 as json object , while comes as number from app2, comes as "one word string" from app3, and multiple words from app 4.

Looked at solutions on this forum and non of them worked.

  • Renaming field moves the problem to new field name.
  • Logstash doesn't provide a way to detect field type on pipeline.

Appreciate help

Thanks
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [error] tried to parse field [error] as object, but found a concrete value"}}}

2

Look at the last option in this post.

1 Like
3

It seems like quite a challenging situation. Have you tried using a Logstash filter to explicitly set the field type based on the source app to address this mapping issue? Wishing you luck in resolving it!

4

@Badger Since most of the logs are object , I am thinking to convert the logs with concrete values to objects instead of other way around .

When field "error" comes as object it usually comes as flat json.

How to convert the "concrete value" to object ?

Thanks

5

Do you know what the error objects look like? If you know the name of one of the fields within [error] then there are other solutions in the post I linked to.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.