"object mapping for [host] tried to parse field [host] as object, but found a concrete value" on filebeat/ingest

Elastic Stack Beats
1

By creation of a new pipeline, the following error began to pop up on the filebeat side:

{"type":"mapper_parsing_exception","reason":"object mapping for [host] tried to parse field [host] as object, but found a concrete value"}

I thought it might be something like the breaking change with the field host even though logstash is not used but instead filebeat feeds directly into the ingest pipeline.

I first tried to add the processor the the filebeat.yml in order to drop the field, but there were no changes observed.
I then tried removing the field from the pipeline, but now I'm becoming the following error:

{"type":"illegal_argument_exception","reason":"field [host] not present as part of path [host]"}

In the pipeline, or the filebeat.yml there is no mention of the field host, so I'm wondering, where does this host field comes from which causes the conflict.

2

This will occur if you have a mix of new v7 filebeat and older v6 filebeats outputting to the same index. This is caused by introduction of ecs.

3

I see, there is quite a few filebeat created by automated process, so it is difficult to find out which filebeat 6 is still being use. Is there a way to work around that?

4

if you use logstash , you can use the filter section to handle it. You can also use processors in beat config to drop this field. Or you can use version dependent indices. Best effor is to make sure all your beat are using the same major version.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.