Object type vs Data type in Filebeat


I'm circling back on this older discussion I posted about object type vs concrete types trying to push data to elasticsearch using filebeat:

The error I've been running into is this:

{"type":"mapper_parsing_exception","reason":"object mapping for [entries] tried to parse field [entries] as object, but found a concrete value"}

I think i've made more sense of this error message in that I originally thought of this as an issue with incorrect data types but what really is happening is an issue with object vs the data itself. What is happening is the value returned for entries is is a value and not an object (nested field/array). I'm taking the field length_stayed which is an integer field parsed from a grok pattern. `This is the script processor that I'm using that is failing:

if(ctx.length_stayed >= 60) { ctx.entries = 1; }

I see that I need to adjust ctx.entries = 1; to an object instead of a root level item I'm just not sure how to accomplish that.


Just bumping this. Could really use the help.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.