Parse failure (object mapping for [trace.detail] tried to parse field [null] as object, but found a concrete value)

Elastic Stack Logstash
1

Hi Team, I basically use json filter to parse log. But somewhere in json have 2 different type of log that's why I get this error (object mapping for [trace.detail] tried to parse field [null] as object, but found a concrete value).

I found where the issue is but not able to fix it. I need support your support :slight_smile:

Problematic part of the log; ( in detail : Account not found. square brackets cause this parse error. )

"trace": [
{
"action": "LOGIN",
"detail": {
"email": "kervanbebe@yaani.com"
},
"level": 200,
"time": 1687292346
},
{
"action": "FORM_INPUTS",
"detail": {
"email": "kervanbebe@yaani.com"
},
"level": 500,
"time": 1687292346
},
{
"action": "LOGIN_ERROR",
"detail": [
"Account not found."
],
"level": 500,
"time": 1687292346
}
],

I tried to split,remove this field but not able to that.

Thanks for help in advance.

2

I would fix that using a ruby filter. You could try

    ruby {
        code => '
            trace = event.get("trace")
            if trace.is_a? Array
                trace.each_index { |i|
                    if trace[i]["detail"].is_a? Array
                        event.set("[trace][#{i}][detail]", { "status" => trace[i]["detail"][0] } )
                    end
                }
            end
        '
    }

so that you end up with

    [2] {
        "detail" => {
            "status" => "Account not found."
        },
        "action" => "LOGIN_ERROR",
         "level" => 500,
          "time" => 1687292346
    }
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.