Object mapping errors

"mapper_parsing_exception", "reason"=>"object mapping for [file] tried to parse field [file] as object, but found a concrete value"}

That is saying that the event has a [file] field that is a string (or number, or date, or whatever)

"file"=>"InitMDCRequestFilter.java"

but elasticsearch expects it to be an object with fields nested inside it. A field on a document cannot be a string on some documents and an object on others.

You will have to modify the event to match what elasticsearch expects. That might be as simple as

mutate { rename => { "[file]" => "[file][name]" } }

or if on some events it is a string and on others an object you might need a conditional test

if ! [file][name] { ... }

or even use ruby to test if event.get("file").is_a? String