[WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index",

[shaonbean]

logstash error

[2017-05-10T08:50:56,328][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-aniutv-access-2017.05.10", :_type=>"aniutv-access", :_routing=>nil}, 2017-05-10T00:50:51.000Z localhost.localdomain %{message}], :response=>{"index"=>{"_index"=>"filebeat-aniutv-access-2017.05.10", "_type"=>"aniutv-access", "_id"=>"AVvv1mKt_b-4JY4-UTwo", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [nginx.access.user_agent.patch]", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "b4""}}}}}

elk version 5.4 +openjdk1.8

when i config elk+filebeat,the can Normal collection log, But after running for a while, the paper is wrong. Who can help to see the above problem.My elk configuration is based on the website, using the filebeat template to collect nginx's access log

please help me...

[magnusbaeck (Magnus Bäck)]

The nginx.access.user_agent.patch field has been mapped as an integer but for at least some of your events the field actually contains a string. Why is it mapped as an integer? Is it because of the Filebeat template?

[shaonbean]

yes, i change office logstash nginx filter template,remove nginx.access.user_agent.patch , logstash can works.

[chaokunyang]

In filebeat 5.3, It's mapped to long. https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-nginx.html#_nginx_access_user_agent_patch
So mapper_parsing_exception will happen too, when patch is string.
Ex:WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse [nginx.access.user_agent.patch]","caused_by":{"type":"number_format_exception","reason":"For input string: "b4""}}