[FIXED] what is the reason for this logstash error("error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper)

Issue

bellow is my filebeat config and I added a logId :

- type: log
 fields:
source: 'filebeat2'
  logID: debugger
fields_under_root: true
enabled: true
 paths:
- /var/log/path/*

and below is my output section of logstash conf :

   if "debugger" in [logID] and ("" not in [Exeption]) {
   elasticsearch {
    user => ""
     password => ""
     hosts => ["https://ip:9200"]
    index => "debugger"
              }
  }

and I put some log files in path(10 files) and I randomely got this error in logstash-plain.log :

{"index"=>{"_index"=>"debugger", "_type"=>"_doc", "_id"=>"9-DmvoIBPs8quoIM7hCa", 
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper 
  [request.dubugeDate] cannot be changed from type [text] to [long]"}}}}

and also this :

 "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field 
   [debug.registrationDate] of type [long] in document with id 'Bt_YvoIBPs8quoIMXfwd'. 
   Preview of field's value: '2022-08-1707:37:08.256'", "caused_by"=> 
   {"type"=>"illegal_argument_exception", "reason"=>"For input string: \"2022-08- 
    1707:37:08.256\""}}}}}

can anybody help me ?

Solution

Look like, in the first case, in the index mapping, your field request.dubugeDate defined as long, and you try to ingest some string data.

In the second case the field debug.registrationDate find mapping, defined as long, and you try to ingest string (date). You can check the mapping of your index with GET /YOUR_INDEX/_mapping command from the Kibana or same via curl

Answered By - Vakhtang

Answer Checked By - David Marino (PHPFixing Volunteer)