Where is the template that elasticsearch uses for syslog indexes? I am using logstash for ingestion

Elastic Stack Elasticsearch
1

I am getting the following error:
[2018-07-02T13:53:58,975][DEBUG][o.e.a.b.TransportShardBulkAction] [syslog-2018.07.02][3] failed to execute bulk item (index) BulkShardRequest [[syslog-2018.07.02][3]] containing [7] requests
org.elasticsearch.index.mapper.MapperParsingException: object mapping for [host] tried to parse field [host] as object, but found a concrete value

When I do a GET /syslog-2018.07.02/_mapping, I get for "host":
},
"host": {
"properties": {
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},

Any idea what if this is the mapping I should be looking at and what I should be changing?

2

As I am no longer able to delete index mapping, I deleted the index, but the issue is continuing. I also see the following error:
Caused by: java.lang.IllegalStateException: Can't get text on a START_OBJECT at 1:71

3

I uninstalled and reinstalled the logstash plugin for syslog and the concrete error went away, however I'm still getting the "failed to parse [host]" error. When I do a search for today's syslog index mappings I can see where the host field is mapped, however I am unable to find the template that is being used to create the index mapping. Does anyone know where that template is? I'm unable to map it to anything that I find when I do a "GET /_template".

4

I have the exact same problem, did you manage to solve it?

5

I uninstalled and reinstall the syslog plugin for logstash and that resolved some of my issues, but I was never able to determine how to edit that template.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.