When writing to ES and get 400 status code, can you get the original log message?

Elastic Stack Logstash
1 
{:status=>400, :action=>["index", {:_id=>nil, :_index=>"monitor3_api_logtail_write", :_type=>"logs", :routing=>nil}, #<LogStash::Event:0x4d7726f5>], 
:response=>{"index"=>{"_index"=>"monitor3_api_logtail-2021.11.25-000685", "_type"=>"logs", "_id"=>"Ko_xWn0B1NtYVV5qtfW-", "status"=>400, 
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [data.query] of type [keyword] in document with id 'Ko_xWn0B1NtYVV5qtfW-'", 
"caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:206"}}}}}

I want to fix this problem from upstream, I need to get the original message content

2

logstash 7.15.2 can solve this problem

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.