Object mapping errors

Elastic Stack Logstash
4

You might (or might not) find this post useful, which talks a little more about these mapping issues.

For renaming fields I would lean toward using mutate rather than ruby. For deciding whether you need to do the mutate ruby would work

ruby {
    code => '
        if event.get("file").is_a? String
            event.set("[@metadata][fileIsString]", true)
        end
    '
}
if [@metadata][fileIsString] {
    mutate { ... }
}

Note the single quotes around the code block of the ruby filter, so that you have the option to use string interpolation when needed.