Object mapping for ... tried to parse field [content_range] as object, but found a concrete value

Elastic Stack Elasticsearch
1

Hello,

Found some informative posts already, but guess I misintepreted some info.

This is logstash logging:
:response=>{"index"=>{"_index"=>"logstash-http-2023.08.14", "_type"=>"_doc", "_id"=>"BobW8okBwOC2FKopPOGW", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [http.content_range] tried to parse field [content_range] as object, but found a concrete value"}}}}

And indeed, most of the time http.content_range is text but sometimes it is delivered as an object.
So I created a filter which is not working so please help:

filter {
   if [event_type] =~ 'http' {
      if [http.content_range] {
         ruby { code => 'event.set("http.content_range", event.get("http.content_range").to_s)' }
      }
   }
}

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.