Open vpavlushkov opened 6 years ago
same here, seen in version 7.6.2
And we are using JSON logging, which causes this event to end up in the DLQ with:
failed to parse field [logstash.log.log_event.url] of type [keyword] in document with id '1TZEBXQBEZXZq8lu6DHu'. Preview of field's value: '{metaClass={metaClass={metaClass={error_message=Elasticsearch Unreachable: [https://xxx:9200/][Manticore::ClientProtocolException]xxx:9200 failed to respond, error_class=LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, url=https://xxx:9200/}}}}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1227"}}}}
Logstash produces some garbage for "Elasticsearch Unreachable" events:
Those extra
metaClass
layers are really unnecessary and, when Logstash logs are getting synced into Elastic, the field type forlogEvent.url
is getting violated as it is not a URL/string anymore but becomes an object.For example "restored connection" event is getting logged like that: