elasticsearch: failed to parse field of type [text]

user_14779496 0
Viewed 4382

I'm getting this error, while trying to insert a document with an object something:

failed to parse field [alert.something] of type [text]
in document with id 'S7wzjXwBoPDEI_MgkgFb'. Preview of field's value: '{a=b}'",

This is the message:

{
          "random" : 1634334912,
          "alert" : {
            "app_key" : "abc",
            "host" : "prod-mongo-1",
            "check" : "heap_size",
            "status" : "warning",
            "something": {
              "a": "b"
            }
          }
}

This is the index template:

{
    "order" : 0,
    "index_patterns" : [
      "rawpayload-*"
    ],
    "settings" : {
      "index" : {
        "mapping" : {
          "coerce" : "false",
          "nested_fields" : {
            "limit" : "50"
          },
          "depth" : {
            "limit" : "20"
          },
          "ignore_malformed" : "false"
        }
      }
    },
    "mappings" : {
      "_source" : {
        "enabled" : true
      },
      "dynamic_templates": [
        {
          "alert_boject": {
            "path_match": "alert.*",
            "match_mapping_type" : "*",
            "mapping": {
              "type": "text"
            }
          }
        }
      ],
      "properties" : {
        "application" : {
          "index" : "false",
          "store" : true,
          "type" : "text"
        }
      }
    }
  }

Can you please point out or help me figure this out :) ?

elasticsearch
2 Answers

As alert.* can be a string or an object, add a new dynamic type mapping for objects.

Your current template accepts any JSON type for alert_boject:

"match_mapping_type" : "*",

But only maps to a JSON string - text - which won't work for objects:

"mapping": {
  "type": "text"
}

Modify the current template to only pick up on text:

{
  "alert_boject": {
    "path_match": "alert.*",
    "match_mapping_type" : "text",
    "mapping": {
      "type": "text"
    }
  }
}

And then create a new template based on the above - change the mapping type (mapping.type) to object so that it accepts an object & change match_mapping_type to object too.

This way you will have 2 templates triggered based on if you have a text field or an object.

"dynamic_templates":[
   {
      "alert_object_text":{
         "path_match":"alert.*",
         "match_mapping_type":"text",
         "mapping":{
            "type":"text"
         }
      }
   },
   {
      "alert_object_object":{
         "path_match":"alert.*",
         "match_mapping_type":"object",
         "mapping":{
            "type":"object"
         }
      }
   }
]
user_48003440

I'm not sure this is a solution but I'd love to hear some opinions. I managed to mitigate the error by adding a template definition:

        {
          "alert_object_parser": {
            "path_match": "alert.*",
            "match_mapping_type" : "object",
            "mapping": {
              "type": "object"
            }
          }
        }

What do you think ?

user_147794960
Related