Type:mapper_parsing_exception , reason:object mapping for [os] tried to parse field [os] as object, but found a concrete value

[Jitendra_Kumhar]

Hello,
I am passing log file with each line as JSON
and my JSON has a field "os": "mac"
That JSON lines are not passed to elastic search and throwing this error in debug mode.

{"type":"mapper_parsing_exception","reason":"object mapping for [os] tried to parse field [os] as object, but found a concrete value"}

Can anyone help with this?

[kvch (Noémi Ványi)]

Could you please share example logs, your configuration formatted using </> and debug logs of Filebeat?

[Jitendra_Kumhar]

error:

(status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [os] tried to parse field [os] as object, but found a concrete value"}

example log:

{"os": "mac", "os_version": "macmo", "browser": "safari", "browser_version": "12.0"}

config

filebeat.inputs:
- type: log
enabled: true
paths:
  - /Users/logs.log
exclude_lines: ['^(?i)([^({_)])']
json.message_key:xxx
json.keys_under_root: true
json.overwrite_keys: false

[bryan_stuhlsatz]

Is it possible to see if your OS field (from the source) at some point was using an array?

[bryan_stuhlsatz]

What is the mapping for the field in your index?
GET /{indexname}/_mapping/field/os

[Jitendra_Kumhar]

{
"filebeat-7.2.0-2019.06.27-000001" : {
"mappings" : { }
}
}

[bryan_stuhlsatz]

if you are sending to logstash, are you using the below as a filter?
json {
source => "message"
}