search

AliyunContainerService / log-pilot

Collect logs for docker containers
https://yq.aliyun.com/articles/674327
Apache License 2.0
1.43k stars 402 forks source link

是否支持ES7；阿里云文档是否有误？ #297

Open totemofwolf opened 4 years ago

totemofwolf commented 4 years ago

参考 利用Log-Pilot + Elasticsearch + Kibana搭建kubernetes日志解决方案 部署在k8s里，目前的log-pilot 日志如下：

time="2020-06-23T00:34:19Z" level=info msg="logs: f60b4a968bed082020aa86db8764f11e30ba736e5120e92e0b115bd05efe7c4c = &{fm-radio-prod /host/var/lib/docker/containers/f60b4a968bed082020aa86db8764f11e30ba736e5120e92e0b115bd05efe7c4c nonex map[time_format:%Y-%m-%dT%H:%M:%S.%NZ] f60b4a968bed082020aa86db8764f11e30ba736e5120e92e0b115bd05efe7c4c-json.log* map[env:prod index:fm-radio-prod topic:fm-radio-prod] false true}"

但是ES中看不到索引...

另外：

          - name: "ELASTICSEARCH_HOSTS"
            value: "{es_endpoint}:{es_port}"
          # 配置ES访问权限
          - name: "ELASTICSEARCH_USER"
            value: "{es_username}"
          - name: "ELASTICSEARCH_PASSWORD"
            value: "{es_password}"

这些 {} 是否要保留？

p45109

bryant-rh commented 4 years ago

我也遇到该情况，es7.8 是不支持吗

totemofwolf commented 4 years ago

另外 log-pilot POD的 /var/log/filebeat/filebeat 日志出现：

2020-06-23T11:28:37+08:00 ERR Failed to connect: Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template: couldn't load template: couldn't load json. Error: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]"}},"status":400}. Response body: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}, url={ignore_above=1024, type=keyword}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, ip={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, offset={type=long}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, program={ignore_above=1024, type=keyword}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, @timestamp={type=date}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}, date_detection=false}]"}},"status":400}

bryant-rh commented 4 years ago

看es日志，貌似是htpps引起的 {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g", "node.id": "StF76zNoQaS8JPYtNYvJWQ" }

totemofwolf commented 4 years ago

看es日志，貌似是htpps引起的 {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g", "node.id": "StF76zNoQaS8JPYtNYvJWQ" }

额？你这个日志哪里来的///？？

totemofwolf commented 4 years ago

看es日志，貌似是htpps引起的 {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g", "node.id": "StF76zNoQaS8JPYtNYvJWQ" }

ES 的日志如下：

"stacktrace": ["org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [doc : {_meta={version=6.1.1}, dynamic_templates=[{fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], date_detection=false, properties={kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, pod={properties={name={ignore_above=1024, type=keyword}}}, namespace={ignore_above=1024, type=keyword}, annotations={type=object}, labels={type=object}}}, apache2={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, remote_ip={ignore_above=1024, type=keyword}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, os={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, client={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, traefik={properties={access={properties={response_code={type=long}, agent={norms=false, type=text}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, backend_url={norms=false, type=text}, http_version={ignore_above=1024, type=keyword}, url={ignore_above=1024, type=keyword}, request_count={type=long}, referrer={ignore_above=1024, type=keyword}, remote_ip={ignore_above=1024, type=keyword}, frontend_name={norms=false, type=text}, body_sent={properties={bytes={type=long}}}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}}}, icinga={properties={debug={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, startup={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}, main={properties={severity={ignore_above=1024, type=keyword}, message={norms=false, type=text}, facility={ignore_above=1024, type=keyword}}}}}, read_timestamp={ignore_above=1024, type=keyword}, source={ignore_above=1024, type=keyword}, auditd={properties={log={properties={res={ignore_above=1024, type=keyword}, new_auid={ignore_above=1024, type=keyword}, item={ignore_above=1024, type=keyword}, new_ses={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, old_ses={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, record_type={ignore_above=1024, type=keyword}, a0={ignore_above=1024, type=keyword}, ppid={ignore_above=1024, type=keyword}, sequence={type=long}, old_auid={ignore_above=1024, type=keyword}, items={ignore_above=1024, type=keyword}, acct={ignore_above=1024, type=keyword}}}}}, error={properties={code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}}, redis={properties={log={properties={role={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, pid={type=long}, message={norms=false, type=text}}}, slowlog={properties={args={ignore_above=1024, type=keyword}, duration={properties={us={type=long}}}, cmd={ignore_above=1024, type=keyword}, id={type=long}, key={ignore_above=1024, type=keyword}}}}}, docker={properties={container={properties={image={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, id={ignore_above=1024, type=keyword}, labels={type=object}}}}}, logstash={properties={log={properties={level={ignore_above=1024, type=keyword}, module={ignore_above=1024, type=keyword}, log_event={type=object}, thread={norms=false, type=text}, message={norms=false, type=text}}}, slowlog={properties={took_in_millis={type=long}, level={ignore_above=1024, type=keyword}, plugin_params={norms=false, type=text}, module={ignore_above=1024, type=keyword}, plugin_type={ignore_above=1024, type=keyword}, took_in_nanos={type=long}, plugin_params_object={type=object}, thread={norms=false, type=text}, event={norms=false, type=text}, plugin_name={ignore_above=1024, type=keyword}, message={norms=false, type=text}}}}}, postgresql={properties={log={properties={duration={type=float}, thread_id={type=long}, database={ignore_above=1024, type=keyword}, level={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, query={ignore_above=1024, type=keyword}, message={norms=false, type=text}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, stream={ignore_above=1024, type=keyword}, beat={properties={hostname={ignore_above=1024, type=keyword}, timezone={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, version={ignore_above=1024, type=keyword}}}, mysql={properties={slowlog={properties={lock_time={properties={sec={type=float}}}, rows_sent={type=long}, rows_examined={type=long}, query={ignore_above=1024, type=keyword}, ip={ignore_above=1024, type=keyword}, host={ignore_above=1024, type=keyword}, id={type=long}, user={ignore_above=1024, type=keyword}, query_time={properties={sec={type=float}}}, timestamp={type=long}}}, error={properties={thread_id={type=long}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, nginx={properties={access={properties={referrer={ignore_above=1024, type=keyword}, response_code={type=long}, agent={norms=false, type=text}, remote_ip={ignore_above=1024, type=keyword}, geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, location={type=geo_point}, region_name={ignore_above=1024, type=keyword}}}, method={ignore_above=1024, type=keyword}, user_name={ignore_above=1024, type=keyword}, http_version={ignore_above=1024, type=keyword}, body_sent={properties={bytes={type=long}}}, url={ignore_above=1024, type=keyword}, user_agent={properties={patch={ignore_above=1024, type=keyword}, major={type=long}, minor={type=long}, os={ignore_above=1024, type=keyword}, os_minor={type=long}, os_major={type=long}, name={ignore_above=1024, type=keyword}, os_name={ignore_above=1024, type=keyword}, device={ignore_above=1024, type=keyword}}}}}, error={properties={level={ignore_above=1024, type=keyword}, connection_id={type=long}, pid={type=long}, message={norms=false, type=text}, tid={type=long}}}}}, offset={type=long}, prospector={properties={type={ignore_above=1024, type=keyword}}}, message={norms=false, type=text}, fileset={properties={module={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}}}, tags={ignore_above=1024, type=keyword}, @timestamp={type=date}, system={properties={auth={properties={hostname={ignore_above=1024, type=keyword}, ssh={properties={geoip={properties={continent_name={ignore_above=1024, type=keyword}, city_name={ignore_above=1024, type=keyword}, country_iso_code={ignore_above=1024, type=keyword}, region_name={ignore_above=1024, type=keyword}, location={type=geo_point}}}, method={ignore_above=1024, type=keyword}, dropped_ip={type=ip}, port={type=long}, signature={ignore_above=1024, type=keyword}, ip={type=ip}, event={ignore_above=1024, type=keyword}}}, pid={type=long}, program={ignore_above=1024, type=keyword}, sudo={properties={tty={ignore_above=1024, type=keyword}, pwd={ignore_above=1024, type=keyword}, error={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, command={ignore_above=1024, type=keyword}}}, useradd={properties={uid={type=long}, gid={type=long}, shell={ignore_above=1024, type=keyword}, name={ignore_above=1024, type=keyword}, home={ignore_above=1024, type=keyword}}}, groupadd={properties={gid={type=long}, name={ignore_above=1024, type=keyword}}}, message={ignore_above=1024, type=keyword}, user={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}, syslog={properties={hostname={ignore_above=1024, type=keyword}, pid={ignore_above=1024, type=keyword}, program={ignore_above=1024, type=keyword}, message={ignore_above=1024, type=keyword}, timestamp={ignore_above=1024, type=keyword}}}}}, meta={properties={cloud={properties={machine_type={ignore_above=1024, type=keyword}, availability_zone={ignore_above=1024, type=keyword}, instance_id={ignore_above=1024, type=keyword}, instance_name={ignore_above=1024, type=keyword}, project_id={ignore_above=1024, type=keyword}, provider={ignore_above=1024, type=keyword}, region={ignore_above=1024, type=keyword}}}}}, kafka={properties={log={properties={component={ignore_above=1024, type=keyword}, trace={properties={message={norms=false, type=text}, class={ignore_above=1024, type=keyword}, full={norms=false, type=text}}}, level={ignore_above=1024, type=keyword}, message={norms=false, type=text}, class={norms=false, type=text}, timestamp={ignore_above=1024, type=keyword}}}}}, fields={type=object}}}]",

totemofwolf commented 4 years ago

看es日志，貌似是htpps引起的 {"type": "server", "timestamp": "2020-06-23T03:21:06,009Z", "level": "WARN", "component": "o.e.x.s.t.n.SecurityNetty4HttpServerTransport", "cluster.name": "elastic", "node.name": "elastic-es-default-0", "message": "received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/100.65.11.6:9200, remoteAddress=/100.65.11.8:43002}", "cluster.uuid": "blyc_Ps6QNiS-U3iMLh88g", "node.id": "StF76zNoQaS8JPYtNYvJWQ" }

0.9.7-filebeat版本镜像不支持，看起来是这原因： ElasticSearch 7.x 默认不在支持指定索引类型

zhangrui153169 commented 4 years ago

"stacktrace": ["org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:

这在elastic和filebeat日志中都有体现。

totemofwolf commented 4 years ago

"stacktrace": ["org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:

这在elastic和filebeat日志中都有体现。

好吧

xxy123456 commented 3 years ago

我也遇到这个问题了，看起来这个项目好像不维护了。这么好的项目为啥呢？

totemofwolf commented 3 years ago

我也遇到这个问题了，看起来这个项目好像不维护了。这么好的项目为啥呢？ 他们自己魔改了 filebeat 6.1.1 用官方的所有其他版本是不行滴。。。。

Echo21bash commented 3 years ago

https://github.com/hebaodanroot/log-pilot.git 这个支持ES7

Zhang21 commented 2 years ago

这个无法直接写入es7，可以到kafka，消费到es7。