devops-general and devops-dev-error pipelines returning erros
Closed this issue · 2 comments
I'm having issues with both devops-dev-error and devops-general pipelines. I'm receiving the following error for both
Could not index event, illegal_state_exception, can't get text on a START_OBJECT.
Error and queries dashboards are not working probably because the above error. The dashboard can't find the data variables message_text and message.object and application.action_name cannot be find within context of os-mon-log-error.
Note my elastic deployment is version 7.17.5
Still having issues with Error and General logs. I believe there is a mapping issue, I'm trying to solve it but I have very limited experience with elastic. I will attach some sample error message below.
[2022-08-07T09:34:19,805][WARN ][logstash.outputs.elasticsearch][devops-general][382af34e987c04c686418bbe2db2fd6709489c05018c83aca0ac22d4c0b7f990] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"664450256", :_index=>"os-mon-log-general", :routing=>nil}, {"user_id"=>2646, "request"=>{"key"=>"574bcabc-2e72-4d84-8d3d-5ca2dc1e3523"}, "log"=>{"data_source"=>"General", "instant"=>"2022-08-07T09:31:23.4214759Z"}, "client_ip"=>"192.168.18.75", "message"=>{"object"=>"CreateOrUpdateQuotationData_.GetQuotationData.List", "type"=>"WARNING", "duration"=>234, "text"=>"Query CreateOrUpdateQuotationData_.GetQuotationData.List took 234 ms (Database: outsystems)"}, "application"=>{"module_name"=>"SLOWSQL", "espace_name"=>"RetailMotor_DB", "espace_id"=>249, "name"=>"Retail Motor"}, "http_poller_metadata"=>{"input"=>{"http_poller"=>{"request"=>{"original"=>{"auth"=>{"user"=>"*******", "pass"=>"*********", "eager"=>true}, "method"=>"get", "headers"=>{"Accept"=>"application/json"}, "url"=>"https**********************"}, "host"=>{"hostname"=>"*****"}, "retry_count"=>0, "name"=>"mp"}, "response"=>{"status_code"=>200, "status_message"=>"OK", "elapsed_time_ns"=>257755, "headers"=>{"date"=>"Sun, 07 Aug 2022 09:34:17 GMT", "transfer-encoding"=>"chunked", "x-protection"=>"1", "cache-control"=>"no-cache", "pragma"=>"no-cache", "content-type"=>"application/json; charset=utf-8", "server"=>"nginx/1.17.9", "connection"=>"keep-alive", "strict-transport-security"=>"max-age=31536000;includeSubDomains", "expires"=>"-1", "x-content-type-options"=>["nosniff", "nosniff"]}}}}}, "outsystems"=>{"customer_name"=>"****", "location_name"=>"********", "environment_name"=>"Online"}, "session"=>{"id"=>"pNfWI3p0P0K1jIMxtopIng=="}, "tenant_id"=>17, "@timestamp"=>2022-08-07T09:31:23.421Z, "@version"=>"1", "ecs"=>{"version"=>"1.5.0"}}], :response=>{"index"=>{"_index"=>"os-mon-log-general-000003", "_type"=>"_doc", "_id"=>"664450256", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [message] of type [match_only_text] in document with id '664450256'. Preview of field's value: '{duration=234, text=Query CreateOrUpdateQuotationData_.GetQuotationData.List took 234 ms (Database: outsystems), type=WARNING, object=CreateOrUpdateQuotationData_.GetQuotationData.List}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:185"}}}}}
I'm trying to ultimately solve an issue where the error dashboard does not display any data.
I was able to finally solve this issue. I found that, for some reason, when the saved objects were first imported, the message field was assigned as text only field instead of an object type. I edited the index template and reindexed the data, and the problem was solved.