elastic / elastic/logstash

When trying to convert hash to string I get failed action with response of 400, dropping action:

Open
#4,033 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

**logstash version = 1.5.4**
**ES_version = 1.7.2**
**java_version = 1.8**
Hi there ,
I am using the output plugin for elasticsearch for a json log. I successfully parse the json part of the log like this

```
json {
source => "json"
}
```

Since the json has a nested json within a field name **params** I get something like this in kibana:
**example json message**

``` json
{"method”:”data”,”path":"data","format":"json","controller":"data","action":"data","status": data,"duration": data,"view": data,"db": data,"params":{"shortname":"data","format":"json"},"@timestamp":"2015-10-14T15:38:47.301Z","@version":"1","message":"[200] GET data (data#data)"}
```

**example field in kibana**

```
params.value.value.value.value = value
```

Since I don't need the param field to parsed as json I want to convert it to string and because that's not possible with a mutate convert command so I tried the following and with all combinations I get the above mentioned error in logstash log file and the log is dropped.

```
mutate {
update => { "params" => "%{params}" }
}
```

```
ruby {
code => "event['params'] = event['params'].to_s"
}
```

There's something in the log that ES output plugin or ES itself doesn't like after I try to convert the params json to string which drops the whole batch

Thanks!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.