Understanding json typing

[Tim_Coote1 (Tim Coote)]

I'm getting errors of this form:

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [valueId.value]", "caused_by"=>{"type"=>"json_parse_exception", "reason"=>"Current token (VALUE_TRUE) not numeric, can not use numeric value accessors\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@6cd61514; line: 1, column: 218]"
```,

which I suspect is because I've got json log entries of this form:

{
"notificationType": "ValueChanged",
"valueId": {
"value": true,
}
}

After log entries of this form:

{
"notificationType": "ValueChanged",
"valueId": {
"value": 3,
}
}

Am I interpreting this correctly - the first log entry is creating a field, name "value" of type "number", and the second has a field of the same name, of type "boolean"?

If I am, what's the best approach? Insert some filter ahead of elasticsearch to change the name of "value" fields to something that depends on the type of their value?  Something else?

If I'm wrong, does anyone have a thought on what is going wrong with the parsing?

tia

Tim

[krmathieu (Kevin M.)]

Tim,

It looks like you have a comma after the "value": 3 key pair but you do not have anything after that in the valueid object. That is not valid JSON and probably why you are getting the error. If you fix that I believe that will resolve your issue.

Kevin

[Krunal_kalaria]

Can you share the json log that you want to parse it.

[Tim_Coote1 (Tim Coote)]

Thanks, Kevin

Actually that's my mistake in obfuscating the json -there was a following field that I'd removed. I should have tested what i put in the posting.

I'll do the process properly and create a complete filebeat/logstash/elasticsearch pipeline and post a minimal log that's creating the issue for me.

tc

[Tim_Coote1 (Tim Coote)]

And when I tried to create a simple test, it worked. So I don't know what I got wrong, but there we are.
Thanks for helping.