Parse json with mapper_parsing_exception

Elastic Stack Elasticsearch
1

Hello,
We are indexing and parsing logfiles containing JSON requests (one per line). We have multiple, completely different request. Most of them can be indexed without any problems. But we have some requests which include a field with the same name once as concrete value and once as object.

Example (simplified request):

{
    "request": {
        "body": {
            "price": {
                "currency": "CHF",
                "value": 100.20
            }
        }
    }
}

or

{
    "request": {
        "body": {
            "price": 100
        }
    }
}

Depending which type of request was indexed first, one or the other cannot be indexed with the following error:
"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [response.body.price] tried to parse field [price] as object, but found a concrete value"

Is there a way to create an index/template to index the price field as object and once as concrete value?

Unfortunately we are not able to change all different types of requests to be indexed, but we are free to change the template.

Best regards,
Tom

2

Hey,

each field can only have one type of mapping, either an object or a concrete field value. What you could do however is to change the structure of your JSON before indexing using an ingest processor. This way you could move the request.body.price field to request.body.price.value and then everything would work as expected.

For more information about processor and the ingest node, see https://www.elastic.co/guide/en/elasticsearch/reference/7.3/ingest.html

3

Thanks for your reply. This seems to work.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.