"reason"=>"failed to parse field [host.name] of type [text] in document with id

Elastic Stack Logstash
1

Logstash outputs below error log.

[2021-04-22T15:00:43,643][WARN ][logstash.outputs.elasticsearch][＜pipeline id＞] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"＜index name＞", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:xxxxxxxx>], :response=>{"index"=>{"_index"=>"＜index name＞", "_type"=>"_doc", "_id"=>"xxxxxxxxxxxxxx", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host.name] of type [text] in document with id 'xxxxxxxxxxxxxxx'.

I using below config of logstash.

input {
   beats {
     port => ＜port number＞
   }
}

filter {
 if "＜server ip＞" in [host][ip] {
      mutate {
       rename => { "message" => "Message" }
       add_field => { "Host" => "＜I using hope hostname.＞" }
      }
 }
}

filter {
    mutate {
        rename => ["[host]", "[host][name]" ]
    }
}

Data flow is below.
Filebeat → Logstash → Elasticsearch

Version is all 7.12.

Please how to do resolve.

2

Hey,
try this :

mutate{
				add_field => { "[host][name]" => "%{[host]}" }
}
3

Do you say mean below?

filter {
    mutate {
        rename => ["[host]", "[host][name]" ]
    }
    mutate{
				add_field => { "[host][name]" => "%{[host]}" }
}
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.