"reason"=>"failed to parse field [host.name] of type [text] in document with id

Logstash outputs below error log.

[2021-04-22T15:00:43,643][WARN ][logstash.outputs.elasticsearch][<pipeline id>] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"<index name>", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:xxxxxxxx>], :response=>{"index"=>{"_index"=>"<index name>", "_type"=>"_doc", "_id"=>"xxxxxxxxxxxxxx", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host.name] of type [text] in document with id 'xxxxxxxxxxxxxxx'.

I using below config of logstash.

input {
   beats {
     port => <port number>
   }
}

filter {
 if "<server ip>" in [host][ip] {
      mutate {
       rename => { "message" => "Message" }
       add_field => { "Host" => "<I using hope hostname.>" }
      }
 }
}

filter {
    mutate {
        rename => ["[host]", "[host][name]" ]
    }
}

Data flow is below.
Filebeat → Logstash → Elasticsearch

Version is all 7.12.

Please how to do resolve.

Hey,
try this :

mutate{
				add_field => { "[host][name]" => "%{[host]}" }
}

Do you say mean below?

filter {
    mutate {
        rename => ["[host]", "[host][name]" ]
    }
    mutate{
				add_field => { "[host][name]" => "%{[host]}" }
}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.