# Object mapping for \[configurationItems.configuration.state\] tried to parse field \[state\] as object, but found a concrete value

**URL:** <https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995>\
**Category:** Elasticsearch\
**Created:** [April 3, 2017, 11:56am UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995 "2017-04-03T11:56:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [April 3, 2017, 11:56am UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/1 "2017-04-03T11:56:47Z")

</div>

Hi.....  
i am trying to parse aws config data into elasticsearch  
here is my configuration for logstash

```
input {
  s3 {
      access_key_id => "XXXXXXXXXXXXXX"
      secret_access_key => "XXXXXXXXXXXXXXXXXX"
      bucket => "bucketname"
      region => "us-east-1"
      prefix => "Config/AWSLogs/XXXXXXXXXXXXx/Config"
      type => "s3"
      add_field => { source => config_new }
      codec => "json"
      interval => "30"
    }
}

output {
  elasticsearch {
    hosts => ["http://192.168.1.36:9200"]
    user => "elastic"
    password => "access"
    index => "config_virginia"
  }
  stdout {codec => rubydebug }
}

```

While i am running this code it is skipping some .gz files(which are in my s3 bucket) and throwing below error

```auto
[2017-03-28T18:03:38,424][WARN][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"config_virginia", :_type=>"s3", :_routing=>nil}, 2017-03-28T12:33:38.249Z %{host} %{message}], :response=>{"index"=>{"_index"=>"config_virginia", "_type"=>"s3", "_id"=>"AVsU6EZyr2lwLlBjHgGB", "status"=>400, _"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [configurationItems.configuration.state] tried to parse field [state] as object, but found a concrete value"_}}}}

```

how can i overcome with this?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 3, 2017, 4:41pm UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/2 "2017-04-03T16:41:04Z")

</div>

I think that you indexed some documents looking like:

```auto
{
  "configurationItems.configuration.state": {
    "foo": "bar"
  }
}

```

But then you have documents like:

```auto
{
  "configurationItems.configuration.state": "bar"
}

```

Which elasticsearch can't accept. Check your source.

---

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [April 4, 2017, 8:34am UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/3 "2017-04-04T08:34:43Z")

</div>

Exactly that is what happening but how can we overcome that would suggest me any other way to do that because of these elasticsearch skipping some events

can multi mapping helps me for single index

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 4, 2017, 9:30am UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/4 "2017-04-04T09:30:45Z")

</div>

You need to fix that by yourself before indexing into elasticsearch. An object can't be a string and vice versa.

May be use logstash to mutate your data or an ingest pipeline may be?

---

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [April 12, 2017, 1:46pm UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/5 "2017-04-12T13:46:22Z")

</div>

Thank you very much for your time  
finally i resolved this error with below configuration

```auto
input {
s3 {
      access_key_id => "xxxxxxxxxxxxxxxxxx"
      secret_access_key => "xxxxxxxxxxxxxxxxxxxx"
      bucket => "bucketname"
      region => "us-east-1"
      prefix => "Config/AWSLogs/"
      type => "s3"
      add_field => { source => config_new }
      #codec => "json"
      interval => "30"
    }
}

filter{
mutate { gsub => ["message", '{"relatedEvents"', '\n{"relatedEvents"'] }
split { terminator => "\n" }
mutate { gsub => ["message", ",$", ""] }
mutate { gsub => ["message", "]}$", "" ] }
json { source => "message" }
}

output {
if "_jsonparsefailure" not in [tags] {
if [configuration][state] =~ /.*/
{
elasticsearch {
hosts => ["http://192.168.1.36:9200"]
user => "elastic"
password => "access"
index => "ytest_1"
}
stdout {codec => rubydebug }
}
else
{
elasticsearch {
hosts => ["http://192.168.1.36:9200"]
user => "elastic"
password => "access"
index => "ytest_2"
}
stdout {codec => rubydebug }
}
}
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2017, 1:50pm UTC](https://discuss.elastic.co/t/object-mapping-for-configurationitems-configuration-state-tried-to-parse-field-state-as-object-but-found-a-concrete-value/80995/6 "2017-05-10T13:50:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.