Object type vs Data type in Filebeat

[gentle_ghost]

Hello,

I'm circling back on this older discussion I posted about object type vs concrete types trying to push data to elasticsearch using filebeat:

Having an issue with filebeat pushing to Elasticsearch

Did you fix the rest of the formatting? Is your elasticsearch really running on https? did you enable security authentication etc. setup certs do all that stuff? Looks like bad creds... that is the error you get with bad creds... pretty simple try to curl from filebeat host with the same host and creds that are in the elasticsearch.output section filebeat.yml see what you get First try this is ignores the self signed cert. curl --insecure -u "username:password" https://elastichost:9200

The error I've been running into is this:

{"type":"mapper_parsing_exception","reason":"object mapping for [entries] tried to parse field [entries] as object, but found a concrete value"}

I think i've made more sense of this error message in that I originally thought of this as an issue with incorrect data types but what really is happening is an issue with object vs the data itself. What is happening is the value returned for entries is is a value and not an object (nested field/array). I'm taking the field length_stayed which is an integer field parsed from a grok pattern. `This is the script processor that I'm using that is failing:

if(ctx.length_stayed >= 60) { ctx.entries = 1; }

I see that I need to adjust ctx.entries = 1; to an object instead of a root level item I'm just not sure how to accomplish that.

Thanks

[gentle_ghost]

Just bumping this. Could really use the help.