I'm getting errors of this form:
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [valueId.value]", "caused_by"=>{"type"=>"json_parse_exception", "reason"=>"Current token (VALUE_TRUE) not numeric, can not use numeric value accessors\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@6cd61514; line: 1, column: 218]"
```,
which I suspect is because I've got json log entries of this form:
{
"notificationType": "ValueChanged",
"valueId": {
"value": true,
}
}
After log entries of this form:
{
"notificationType": "ValueChanged",
"valueId": {
"value": 3,
}
}
Am I interpreting this correctly - the first log entry is creating a field, name "value" of type "number", and the second has a field of the same name, of type "boolean"?
If I am, what's the best approach? Insert some filter ahead of elasticsearch to change the name of "value" fields to something that depends on the type of their value? Something else?
If I'm wrong, does anyone have a thought on what is going wrong with the parsing?
tia
Tim