Super-noob needs help with a mapping error

Hey everyone, I have an issue indexing a log message. It's a mapping error.

"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [messageObject] of type [text]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:2364"

The field messageObject is mapped like so:

"messageObject" : {
"properties" : {
"ClassName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256

The messages are being stored in a dead letter queue, so when I check an example, I can see that the message in question has a very long messageObject field. I'm really new at this, so any help interpreting and fixing this is much appreciated.

It appears that you're sending an object to a field that is already mapped as a text field, e.g.

{ "messageObject": { "someField": "someValue" }}

where the mapping would expect

{"messageObject": "someText"}

Please ensure that the data is formatted in a consistent way. Elasticsearch does not support mixing text and object data types for the same field.

Thanks Magnus
We're pulling in data from multiple sources, so it may take some time to fix that. How would I go about changing the mapping to accommodate both a text field and an object? Can I cast the text as an object from logstash?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.