When creating the pipeline I have to remove the [ and ] characters from the pattern, because if not the pattern is not valid. And the error I get is:
... object mapping for [user] tried to parse field [user] as object, but found a concrete value"}, dropping event!","service.name":"filebeat","ecs.version":"1.6.0"}
How can I remove the brackets from the user and store the data on ElasticSearch? I tried with adding slash before without, but does not work in the pipeline.
user Is it defined field and it is an complex object see here.
You are trying to write a simple field into an object again, that's what the error means
Try this instead user.name
Also, using GREEDYDATA for every field is not efficient.
You should look at predefined patterns.
If you share your whole pipeline we might be able to help
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.