I'm getting this error, while trying to insert a document with an object something
:
failed to parse field [alert.something] of type [text]
in document with id 'S7wzjXwBoPDEI_MgkgFb'. Preview of field's value: '{a=b}'",
This is the message:
{
"random" : 1634334912,
"alert" : {
"app_key" : "abc",
"host" : "prod-mongo-1",
"check" : "heap_size",
"status" : "warning",
"something": {
"a": "b"
}
}
}
This is the index template:
{
"order" : 0,
"index_patterns" : [
"rawpayload-*"
],
"settings" : {
"index" : {
"mapping" : {
"coerce" : "false",
"nested_fields" : {
"limit" : "50"
},
"depth" : {
"limit" : "20"
},
"ignore_malformed" : "false"
}
}
},
"mappings" : {
"_source" : {
"enabled" : true
},
"dynamic_templates": [
{
"alert_boject": {
"path_match": "alert.*",
"match_mapping_type" : "*",
"mapping": {
"type": "text"
}
}
}
],
"properties" : {
"application" : {
"index" : "false",
"store" : true,
"type" : "text"
}
}
}
}
Can you please point out or help me figure this out :) ?
CodePudding user response:
As alert.*
can be a string or an object, add a new dynamic type mapping for objects.
Your current template accepts any JSON type for alert_boject
:
"match_mapping_type" : "*",
But only maps to a JSON string - text
- which won't work for objects:
"mapping": {
"type": "text"
}
Modify the current template to only pick up on text
:
{
"alert_boject": {
"path_match": "alert.*",
"match_mapping_type" : "text",
"mapping": {
"type": "text"
}
}
}
And then create a new template based on the above - change the mapping type (mapping.type
) to object
so that it accepts an object & change match_mapping_type
to object
too.
This way you will have 2 templates triggered based on if you have a text
field or an object
.
"dynamic_templates":[
{
"alert_object_text":{
"path_match":"alert.*",
"match_mapping_type":"text",
"mapping":{
"type":"text"
}
}
},
{
"alert_object_object":{
"path_match":"alert.*",
"match_mapping_type":"object",
"mapping":{
"type":"object"
}
}
}
]
CodePudding user response:
I'm not sure this is a solution but I'd love to hear some opinions. I managed to mitigate the error by adding a template definition:
{
"alert_object_parser": {
"path_match": "alert.*",
"match_mapping_type" : "object",
"mapping": {
"type": "object"
}
}
}
What do you think ?