# org.elasticsearch.index.mapper.MapperParsingException: failed to parse \[error\] **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 28, 2017, 5:19pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487 "2017-12-28T17:19:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [December 28, 2017, 5:19pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/1 "2017-12-28T17:19:47Z")
I followed [MySQL module | Filebeat Reference [6.1] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-mysql.html#configuring-mysql-module) to configure filebeat's module: ``` [root@7svdbm01 ~]# cat /etc/filebeat/modules.d/mysql.yml - module: mysql # Error logs error: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: ["/var/log/mariadb/mariadb.log"] # Slow logs slowlog: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: ["/var/lib/mysql/7svdbm01-slow.log"] [root@7svdbm01 ~]# ``` yet getting following error in elasticsearch's log: ``` [2017-12-27T21:31:24,312][DEBUG][o.e.a.b.TransportShardBulkAction] [filebeat-6.1.1-2017.12.27][0] failed to execute bulk item (index) BulkShardRequest [[filebeat-6.1.1-2017.12.27][0]] containing [index {[filebea t-6.1.1-2017.12.27][doc][XbP1mmABalgviv2OvS2X], source[{"@timestamp":"2017-12-28T02:31:22.211Z","offset":7687579,"beat":{"hostname":"7svdbm01.uftwf.local","name":"7svdbm01.uftwf.local","version":"6.1.1"},"prospe ctor":{"type":"log"},"source":"/var/lib/mysql/7svdbm01-slow.log","message":"# Time: 171227 21:31:19","fileset":{"module":"mysql","name":"slowlog"},"error":{"message":"Provided Grok expressions do not match field value: [# Time: 171227 21:31:19]"}}]}] org.elasticsearch.index.mapper.MapperParsingException: failed to parse [error] ..... Caused by: java.lang.IllegalStateException: Can't get text on a START_OBJECT at 1:312 ..... ``` * * * It looks like has something to do with mapping, however template seems to be set fine: ``` # curl --silent --request GET elasticsearch:9200/_cat/templates/filebeat-* filebeat-6.1.1 [filebeat-6.1.1-*] 1 filebeat-6.1.0 [filebeat-6.1.0-*] 1 # ``` Please advise. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [January 4, 2018, 12:39pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/2 "2018-01-04T12:39:25Z")
It's not the mapping, but the grok pattern not matching `# Time: 171227 21:31:19`. The message is somewhat short... I think this should be a multiline event, not just the timestamp. Can you check the slow log entry having some actual contents, besides the timestamp? ---
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [January 8, 2018, 9:20pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/3 "2018-01-08T21:20:02Z")
following is _grep_ line with additional before and after line of `/var/lib/mysql/7svdbm01-slow.log`: ``` [root@7svdbm01 ~]# grep -A1 -B1 '# Time: 171227 21:31:19' /var/lib/mysql/7svdbm01-slow.log DELETE FROM node_revisions where vid in (SELECT vid FROM node WHERE type = '' AND uid = 0); # Time: 171227 21:31:19 # User@Host: X[X] @ X.X.X [X.X.X.X] [root@7svdbm01 ~]# ``` this is standard slow.log file, I haven't had a need to customize it anyhow... ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [January 9, 2018, 3:16pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/4 "2018-01-09T15:16:53Z")
Is the file starting with a `#Time` line? I think that can happen and results in an error, but the rest of the entries should be correctly parsed and indexed. If you can share a portion of the slow log that triggers the error, I can see if it reproduces on my computer. ---
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [January 9, 2018, 4:47pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/5 "2018-01-09T16:47:06Z")
@tudor yes, file has a line that starts with _# Time_ (see below): ``` [root@7svdbm01 ~]# grep '^# Time: 171227 21:31:19' /var/lib/mysql/7svdbm01-slow.log # Time: 171227 21:31:19 [root@7svdbm01 ~]# ``` * * * regardless to that error, I do _NOT_ see any slow log queries via Kibana (`[Filebeat MySQL] Overview`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2018, 4:47pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487/6 "2018-02-06T16:47:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.