Hi there. I am debugging a Logstash filter pipeline that occasionally throws an Elasticsearch indexing error.
Long story short is that I am trying to parse a log message from an application into key-value pairs using a Ruby filter. Sometimes the log message is broken into key/value pairs incorrectly, and a string value is returned for a field that should be a Long.
I don't need to go into too much detail; I'm just looking for a way to make Logstash trap the mapper_parsing_exception and save the original event data to another index or to a Kafka topic or a file... really, to anything that lets me examine the original event and try to work backward to find my bug.
Is there such a mechanism in Logstash? I'm currently using version 6.7.1.