# Upgrade to logstash 5, got mapper\_parsing\_error

**URL:** <https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216>\
**Category:** Logstash\
**Created:** [June 13, 2017, 2:45pm UTC](https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216 "2017-06-13T14:45:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![davelncn](https://avatars.discourse-cdn.com/v4/letter/d/b4bc9f/32.png) [@davelncn](https://discuss.elastic.co/u/davelncn)\
**Post date:** [June 13, 2017, 2:45pm UTC](https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216/1 "2017-06-13T14:45:51Z")

</div>

Hi, I upgraded logstash from v2.2 to 5.4 recently, got mapper\_parsing\_error, same grok pattern works on previous version, and verified on "[http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/)" as well, could someone help me out on this issue? Many thanks!

log example:  
2017-06-03 09:46:28 [http-/0.0.0.0:8080-4] DEBUG [endpoint=GET /transactions/credit, sourceIp=10.195.182.201, requestId=4c3e702e-d01c-46d6-ba95-7be58c2082c1, customerId=2999, accountNumber=6510, branch=3750, deviceId=g6/wFMM6VCm+/LYXbNrtHEUVHsMwM8HokTbYrm32krMlbQY/FMUO5n1WA4aFbzq7] b.c.b.n.p.c.dao.LoggableJdbcTemplate - Executing prepared SQL query

grok pattern:  
(?\<syslog\_time\>20%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}))%{SPACE}[%{DATA:thread}]%{SPACE}%{LOGLEVEL:level}%{SPACE}[%{GREEDYDATA:kvpairs}]%{SPACE}%{JAVACLASS:class}%{SPACE}-%{SPACE}%{JAVALOGMESSAGE:java\_message}

parsing error in logstash log file:  
[2017-06-13T14:00:38,032][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"filebeat-2017.06.13", :\_type=\>"syslog", :\_routing=\>nil}, 2017-06-03 09:46:28 [http-/0.0.0.0:8080-4] DEBUG [endpoint=GET /transactions/credit, sourceIp=10.195.182.201, requestId=4c3e702e-d01c-46d6-ba95-7be58c2082c1, customerId=2999, accountNumber=6510, branch=3750, deviceId=g6/wFMM6VCm+/LYXbNrtHEUVHsMwM8HokTbYrm32krMlbQY/FMUO5n1WA4aFbzq7] b.c.b.n.p.c.dao.LoggableJdbcTemplate - Executing prepared SQL query], :response=\>{"index"=\>{"\_index"=\>"filebeat-2017.06.13", "\_type"=\>"syslog", "\_id"=\>"AVyhwZeNs5aALyvA1py5", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [syslog\_time]", "caused\_by"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"error parsing field [syslog\_time], expected an object but got syslog\_time"}}}}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2017, 8:16pm UTC](https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216/2 "2017-06-13T20:16:50Z")

</div>

It looks like your `syslog_time` field has been mapped as an object in your index but in the events you're trying to index it's no longer an object. Temporarily replace the elasticsearch output with a `stdout { codec => rubydebug }` output so that you can see exactly what the events look like. Compare those results to the mapping of the index. Use ES's get mapping API to obtain it.

---

<div class="post-metadata">

**Author:** ![davelncn](https://avatars.discourse-cdn.com/v4/letter/d/b4bc9f/32.png) [@davelncn](https://discuss.elastic.co/u/davelncn)\
**Post date:** [June 14, 2017, 2:37pm UTC](https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216/3 "2017-06-14T14:37:55Z")

</div>

I cleared old mapping, it works now. thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 2:38pm UTC](https://discuss.elastic.co/t/upgrade-to-logstash-5-got-mapper-parsing-error/89216/4 "2017-07-12T14:38:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.