Hey everyone, I have an issue indexing a log message. It's a mapping error.
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [messageObject] of type [text]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:2364"
The messages are being stored in a dead letter queue, so when I check an example, I can see that the message in question has a very long messageObject field. I'm really new at this, so any help interpreting and fixing this is much appreciated.
Thanks Magnus
We're pulling in data from multiple sources, so it may take some time to fix that. How would I go about changing the mapping to accommodate both a text field and an object? Can I cast the text as an object from logstash?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.