Unexpected type mapstr.M warning


I'm sending JSON logs using filebeat and suddenly I started to get this error:

{"log.level":"warn","@timestamp":"2022-12-08T23:33:51.575+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/matcher.go","file.line":96},"message":"unexpected type mapstr.M in contains condition as it accepts only strings.","service.name":"filebeat","ecs.version":"1.6.0"}

Can't understand what exactly causing it. I checked all log entries, all of them are valid JSON's ...

Thank you in advance.

Hi Alex,

Welcome to Community!
It seems your contains condition is throwing an error as it is expecting strings only. Check your filebeat processors configuration?
More details here: Define processors | Filebeat Reference [8.5] | Elastic


Thank you for the welcome :wink:

The only processors section that I have is the default one:

  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

If you are not using that contains condition , you can remove it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.