Occasional mapping failure for numeric field

Elastic Stack Logstash
1

I am getting occasional mapping errors like this:

"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "%{[doc][geoip][latitude]}""}}

The mapping is numeric type, and I get hundreds of thousands of good documents through, while maybe 10 documents fail each hour. How can i visualise or send to an alternative index the 10 documents that are failing?

I imagine i should use an "if" on the output, but I cant find a statement which works.

I would like something like

if [doc][geoip][latitude] is not a number datatype {
send to different index
}

But i cant find a way to do if " is not a number"

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.