# Object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value **URL:** \ **Category:** Elasticsearch\ **Created:** [June 4, 2019, 1:47pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200 "2019-06-04T13:47:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [June 4, 2019, 1:47pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/1 "2019-06-04T13:47:22Z")
We have just upgraded Kibana, Logstash, Filebeat and Elasticseach from 6.3 to 7.1.1 and I have been trying to solve the issue in the following logs /var/log/elasticsearch/elasticsearch.log: ``` [2019-06-04T09:33:31,761][DEBUG][o.e.a.b.TransportShardBulkAction] [hostname] [filebeat-6.3.0-2019.06.04][0] failed to execute bulk item (index) index {[filebeat-6.3.0-2019.06.04][doc][mNGxImsBFBvUZWvX4i_w], source[{"input":{"type":"log"},"clientIP":"144.123.1234.123","status":"200","@timestamp":"2019-06-04T13:33:25.559Z","timestamp":"04/Jun/2019:09:33:10 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n172.16.4.3 - - [04/Jun/2019:09:33:11 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n144.123.1234.123 - - [04/Jun/2019:09:33:13 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n172.16.4.3 - - [04/Jun/2019:09:33:13 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n144.123.1234.123 - - [04/Jun/2019:09:33:15 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n172.16.4.3 - - [04/Jun/2019:09:33:15 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n144.123.1234.123 - - [04/Jun/2019:09:33:17 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n144.123.1234.123 - - [04/Jun/2019:09:33:17 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n144.123.1234.123 - - [04/Jun/2019:09:33:19 -0400] \"GET /lb/healthcheck.html HTTP/1.0\" 200 2\n162.209.84.28 - - [04/Jun/2019:09:33:19 -0400","host":"Michael1","request":"/","prospector":{"type":"log"},"source":"/usr/share/apache-tomcat-8.0.28/logs/localhost_access_log..2019-06-04.txt","method":"GET","@version":"1","ts":"2019-06-04T13:33:25.559Z","bytesSent":135,"offset":2834670}]} org.elasticsearch.index.mapper.MapperParsingException: object mapping for [host] tried to parse field [host] as object, but found a concrete value ``` Here is my /etc/logstash/conf.d/10-syslog-filter.conf ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` Here is my /etc/logstash/conf.d/20-filter-tomcat-logs.conf ``` filter { # access.log if ([source] =~ /.*\.txt$/) { grok { # Access log pattern is %a %{waffle.servlet.NegotiateSecurityFilter.PRINCIPAL}s %t %m %U%q %s %B %T "%{Referer}i" "%{User-Agent}i" # 10.0.0.7 - - [03/Sep/2017:10:58:19 +0000] "GET /pki/scep/pkiclient.exe?operation=GetCACaps&message= HTTP/1.1" 200 39 match => ["message" , "%{IPV4:clientIP} - %{NOTSPACE:user} \[%{DATA:timestamp}\] \"%{WORD:method} %{NOTSPACE:request} HTTP/1.1\" %{NUMBER:status} %{NUMBER:bytesSent}" ] remove_field => ["message"] add_field => { "[@metadata][cassandra_table]" => "tomcat_access" } } grok{ match => ["request", "/%{USERNAME:app}/"] tag_on_failure => [] } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] remove_field => ["timestamp"] } ruby { code => "event.set('ts', event.get('@timestamp'))" } mutate { lowercase => ["user"] convert => ["bytesSent", "integer", "duration", "float"] update => { "host" => "%{[beat][hostname]}" } remove_field => ["beat","type","geoip","input_type","tags"] } if [user] == "-" { mutate { remove_field => ["user"] } } # drop unmatching message (like IPv6 requests) if [message] =~ /(.+)/ { drop { } } } } ``` Here is my /etc/logstash/conf.d/30-elasticsearch-output.conf: ``` output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false #index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` Does anyone have experience with this issue and resolved it? Please let me know if you have any questions. ---
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [June 5, 2019, 7:20pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/2 "2019-06-05T19:20:10Z")
Not sure if this was the solution but once I updated my /etc/logstash/conf.d/20-filter-tomcat-logs.conf: ``` from update => { "host" => "%{[beat][hostname]}" } to rename => { "[host][name]" => "[hostname]" } ``` it stopped spitting out the debug messages ---
**Author:** ![Chris\_Denneen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_denneen/32/1254_2.png) [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Post date:** [June 5, 2019, 7:54pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/3 "2019-06-05T19:54:16Z")
With ECS 1.0 I believe host is an object to conform so you might have to modify your fields to conform as well rather than moving `[host][name] -> hostname` ... use `[host][name]` ---
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [June 5, 2019, 8:47pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/4 "2019-06-05T20:47:49Z")
Hi @Chris_Denneen, I'm not exactly sure what you mean, would you mind explaining this please? ---
**Author:** ![Chris\_Denneen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_denneen/32/1254_2.png) [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Post date:** [June 6, 2019, 6:36pm UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/5 "2019-06-06T18:36:26Z")
Host in the [ECS](https://www.elastic.co/blog/introducing-the-elastic-common-schema) spec is an object > so now it's ``` host: name: my hostname ip: 10.1.10.10 ``` Where "host" encapsulates "host" related data. ---
**Author:** ![fhlmbrg](https://avatars.discourse-cdn.com/v4/letter/f/e480ec/32.png) [@fhlmbrg](https://discuss.elastic.co/u/fhlmbrg)\ **Post date:** [June 14, 2019, 8:25am UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/6 "2019-06-14T08:25:42Z")
So the correct way going forward is to use the `host` field as an object instead of a string? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2019, 8:25am UTC](https://discuss.elastic.co/t/object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/184200/7 "2019-07-12T08:25:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.