# Type:mapper\_parsing\_exception , reason:object mapping for \[os\] tried to parse field \[os\] as object, but found a concrete value

**URL:** <https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 25, 2019, 11:49am UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320 "2019-06-25T11:49:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)\
**Post date:** [June 25, 2019, 11:49am UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/1 "2019-06-25T11:49:00Z")

</div>

Hello,  
I am passing log file with each line as JSON  
and my JSON has a field "os": "mac"  
That JSON lines are not passed to elastic search and throwing this error in debug mode.

{"type":"mapper\_parsing\_exception","reason":"object mapping for [os] tried to parse field [os] as object, but found a concrete value"}

Can anyone help with this?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 25, 2019, 4:52pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/2 "2019-06-25T16:52:13Z")

</div>

Could you please share example logs, your configuration formatted using `</>` and debug logs of Filebeat?

---

<div class="post-metadata">

**Author:** ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)\
**Post date:** [June 26, 2019, 6:37am UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/3 "2019-06-26T06:37:34Z")

</div>

error:

(status=400): {"type":"mapper\_parsing\_exception","reason":"object mapping for [os] tried to parse field [os] as object, but found a concrete value"}

example log:

{"os": "mac", "os\_version": "macmo", "browser": "safari", "browser\_version": "12.0"}

config

```
filebeat.inputs:
- type: log
enabled: true
paths:
  - /Users/logs.log
exclude_lines: ['^(?i)([^({_)])']
json.message_key:xxx
json.keys_under_root: true
json.overwrite_keys: false
```

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [June 26, 2019, 8:49pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/4 "2019-06-26T20:49:12Z")

</div>

Is it possible to see if your OS field (from the source) at some point was using an array?

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [June 26, 2019, 8:53pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/5 "2019-06-26T20:53:02Z")

</div>

What is the mapping for the field in your index?  
GET /{indexname}/\_mapping/field/os

---

<div class="post-metadata">

**Author:** ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)\
**Post date:** [June 27, 2019, 12:07pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/6 "2019-06-27T12:07:51Z")

</div>

{  
"filebeat-7.2.0-2019.06.27-000001" : {  
"mappings" : { }  
}  
}

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [June 27, 2019, 9:13pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/7 "2019-06-27T21:13:21Z")

</div>

if you are sending to logstash, are you using the below as a filter?  
json {  
source =\> "message"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2019, 9:13pm UTC](https://discuss.elastic.co/t/type-mapper-parsing-exception-reason-object-mapping-for-os-tried-to-parse-field-os-as-object-but-found-a-concrete-value/187320/8 "2019-07-25T21:13:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.