Snow API not working with logstash

Elastic Stack Logstash
1

Hi,
Im trying to query a snow API with the below configuration in Logstash 7.2.0,

input {
  http_poller {
    urls => {
    snowinc => {
    url => "https://l.service-now.com/api/now/table/incident?sysparm_limit=10"
    user => "logstash_user"
    password => "hello123"
    headers => {Accept => "application/json"}
    }
}
request_timeout => 60
metadata_target => "http_poller_metadata"
schedule => { cron => "* * * * * UTC"}
codec => "json"
}
}
output {
  elasticsearch {
    hosts => ["10.116.55.24:9200"]
    index => "snowinc"
}
        stdout { codec => rubydebug }
}

However, I do not see any data in my index. (index got created with no data)
I am able to see data from the url when I try to curl the same. So im sure there is data i the API URL.

Logs show the below error:

`

[2019-12-24T01:28:01,510][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"snowinc", :_type=>"_doc", :routing=>nil}, #LogStash::Event:0x13fbd67c], :response=>{"index"=>{"_index"=>"snowinc", "_type"=>"_doc", "id"=>"OkiXNm8Be2NFZrotRzc", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [result.assigned_to] of different type, current_type [text], merged_type [ObjectMapper]"}}}}

`

Kindly help figure out where im going wrong.

thanks in advance :slight_smile:

Regards,
Katara

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.