[WARN ] 2021-05-06 23:01:18.054 [[marketdata_fix_pipeline]>worker0] split - Only String and Array types are splittable. field:[layers][fix] is of type = Hash

Elastic Stack Logstash
1

Hi,

I am getting this warning message and I believe it is because some of the events do not have a [layers][fix].

[WARN ] 2021-05-06 23:01:18.054 [[marketdata_fix_pipeline]>worker0] split - Only String and Array types are splittable. field:[layers][fix] is of type = Hash

Here is what I have in my logstash.config and I am trying to understand why events would continue through this conditional if they don't have a [layers][fix].

if [msg_count] > 1 and [layers][fix] {
  split {
    field => "[layers][fix]"
    add_tag => [ "multi-message" ]
  }
}

Thanks!!
Wei

2

No, it is because [layers][fix] is a hash. That is, there are fields inside it, maybe something like [layers][fix][fix_fix_SendingTime].

3

you are correct Badger. there are multiple fix under the layer and i am trying to split them by the [layer][fix]. I see the split_failure tag on the events that don’t have the [layer][fix] present and am wondering how i can skip the split on those. Shouldn’t my conditional work?

4

I found the issue. I was counting the number of occurrences of _Begin and lo' and behold this particular event actually had two even though it only had one [layer][fix] which caused by split failure.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.