Parsing error when reading from redis

Elastic Stack Logstash
1

I am seeing the following error when reading a Json event from Redis. 'Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log4net-2018.06.25", :_type=>"test", :_routing=>nil}, #LogStash::Event:0x4d91924e], :response=>{"index"=>{"_index"=>"log4net-2018.06.25", "_type"=>"test", "_id"=>"Re6_NWQB00WvXcASSa5s", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [JSONObject] tried to parse field [JSONObject] as object, but found a concrete value"}}}}'.

The event I believe the error is occurring on is {
"host": "1",
"sysloglevel": 7,
"timestamp": "1529563119.65299",
"LoggerName": "Program",
"line": "33",
"JSONObject": {
"Name": "theName",
"Description": "theDescription"
},
"message": "See JSONObject",
"Environment": "local",
"Level": "DEBUG",
"accountId": "262",
"employeeId": "231123"
}

Can anyone assist with getting to the root of the error.

2

I don't think that's the offending event. I think you have another event where JSONObject is e.g. a string (or some other non-object type).

What's the mapping of the JSONObject field in Elasticsearch? Use the get mapping API.

3

Interesting you say that, I do have 2 events that pass out the below in the jsonobject the fields contain a forward slash before the quotations.
"JSONObject": "[ { "mykey": "myvalue" }, { "mykey2": "myvalue2" }, { "Message": "my message hello world" }, { "IntegerValue": "123" } ]",

Your help is muchly appreciated.

4

In this example JSONObject is clearly a string.

5

Have you got any recommendations on how we handle Json objects in ES?

6

I don't understand your question.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.