Object mapping for [data.value] tried to parse field [value] as object, but found a concrete value

Elastic Stack Logstash
1

Hi,
I'm trying to read log files from s3 bucket, but for some log lines I'm getting the below error


  [WARN ] 2022-09-21 10:43:42.756 [[main]>worker0] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"terminal_app_index", :routing=>nil}, {"hostname"=>"DESKTOP-RLPH5F5", "level"=>30, "msg"=>"Locker_Status", "v"=>0, "type"=>"s3", "data"=>{"linkedBusinessClientName"=>"name", "linkedLogisticOwnerId"=>"121212", "linkedBusinessClientId"=>"5121212", "value"=>"{\"total\":16,\"used\":6,\"defective\":1,\"free\":9}", "linkedLogisticOwnerName"=>"name", "message"=>"Locker Status"}, "time"=>"2022-09-21 10:40:56.473", "shortName"=>"p_terminal_106", "name"=>"elk_s3", "@timestamp"=>2022-09-21T10:40:56.473Z, "pid"=>576, "event"=>{"original"=>"{\"name\":\"smartbox_elk_s3\",\"hostname\":\"DESKTOP-RLPH5F5\",\"pid\":576,\"level\":30,\"shortName\":\"terminal_106\",\"data\":{\"message\":\"Locker Status\",\"value\":\"{\\\"total\\\":16,\\\"used\\\":6,\\\"defective\\\":1,\\\"free\\\":9}\",\"linkedBusinessClientId\":\"5121212\",\"linkedBusinessClientName\":\"name\",\"linkedLogisticOwnerId\":\"121212\",\"linkedLogisticOwnerName\":\"name\"},\"time\":\"2022-09-21 10:40:56.473\",\"msg\":\"Locker_Status\",\"v\":0}\r\n"}, "@version"=>"1"}], :response=>{"index"=>{"_index"=>"terminal_app_index", "_id"=>"01GlX4MBo1CgdT5ldlwh", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [data.value] tried to parse field [value] as object, but found a concrete value"}}}}

The log line looks something like this

{"name":"smartbox_elk_s3","hostname":"DESKTOP-EILLS8F","pid":6548,"level":30,"shortName":"name","data":{"message":"Locker Status","value":"{\"total\":78,\"used\":24,\"defective\":5,\"free\":49}","linkedBusinessClientId":"e31c44c8","linkedBusinessClientName":"name","linkedLogisticOwnerId":"b417d92a-4f42","linkedLogisticOwnerName":"name"},"time":"2022-09-20 07:58:25.702","msg":"Locker_Status","v":0}

I have not put any filters on logstash config. This was working fine on logstash 7.17 but not working for logstaash 8.2.2.

Please help anyone

2

See this thread, which tries to explain the issue and discusses some possible solutions.

3

This was helpful, I correctly understood that actual issue.
I created a new index, made sure the field had always the same type. There were some log lines in which the field type was different, removed them and the issue was fixed.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.