Hello,
i`m using the logging feature now for a while i send the logs to an elasticseach cluster. Everything worked fine so far. Now i have enabled the “Enable JSON Parsing” because our Developers want to log in json format. But now i get an error if the following json gets logged.
{"@timestamp":“2020-06-03T14:08:17.429Z”, “log.level”: “WARN”, “message”:"Authentication event AuthenticationFailureBadCredentialsEvent: …}
The Error is this one:
error_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error=“400 - Rejected by Elasticsearch” [error type]: mapper_parsing_exception [reason]: 'Could not dynamically add mapping for field [log.level]. Existing mapping for [log] must be of type object but found [text]
Is there a way that i get these messages correctly send to elasticsearch?
On elasticsearch i have enabled dynamic mapping. I tried to modify the mapping but i think then all the other rancher logs will not be sent correctly.
Is there anything i can do on the rancher side?
Thank you for your help and feedback.
Regards,
Martin