Warning in Logstash

Question

Warning in Logstash

Speedy1971 opened this issue 5 years ago · 1 comments

Speedy1971 commented 5 years ago

Hi, there is a logstash warning and the data are not indexed in elaticsearch, the warning is:
[WARN ][logstash.filters.split ] Only String and Array types are splittable. field:zeek is of type = NilClass
any suggestions?

Answer 1 · 2019-12-22T02:22:06.000Z

Hi @Speedy1971, likely an issue with one of the Zeek logs that we do not yet support. In all likelihood conn.log records are not getting dropped. We'll attempt to replicate and address.