Packetbeat - Postgres - pgsql.error_code parsing issues

Elastic Stack Beats
1

Hello,

The Packetbeat Postgrespgsql.error_code can also contain non-long type data, such as 42P01

https://www.postgresql.org/docs/8.2/static/errcodes-appendix.html

[2018-08-29T14:31:17,274][DEBUG][o.e.a.b.TransportShardBulkAction] [packetbeat-6.3.2-2018.08.29][2] failed to execute bulk item (index) BulkShardRequest [[packetbeat-6.3.2-2018.08.29][2]] containing [10] requests
org.elasticsearch.index.mapper.MapperParsingException: failed to parse [pgsql.error_code]
        at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:302) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrField(DocumentParser.java:481) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.DocumentParser.parseValue(DocumentParser.java:603) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.DocumentParser.innerParseObject(DocumentParser.java:403) ~[elasticsearch-6.3.2.jar:6.3.2]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_131]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]
Caused by: java.lang.IllegalArgumentException: For input string: "42P01"
        at org.elasticsearch.common.xcontent.support.AbstractXContentParser.toLong(AbstractXContentParser.java:199) ~[elasticsearch-x-content-6.3.2.jar:6.3.2]
        at org.elasticsearch.common.xcontent.support.AbstractXContentParser.longValue(AbstractXContentParser.java:220) ~[elasticsearch-x-content-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType$7.parse(NumberFieldMapper.java:679) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType$7.parse(NumberFieldMapper.java:655) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.NumberFieldMapper.parseCreateField(NumberFieldMapper.java:996) ~[elasticsearch-6.3.2.jar:6.3.2]
        at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:297) ~[elasticsearch-6.3.2.jar:6.3.2]
        ... 64 more

At the moment the data type is long

https://www.elastic.co/guide/en/beats/packetbeat/current/exported-fields-pgsql.html

Should I create a GitHb issue for this?

Grtz

Willem

2

Yes please, and paste the link here. error_code should have type keyword not long.

3

GitHub issue created => https://github.com/elastic/beats/issues/8241

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.