Logstash .raw fields are not created

Question

Logstash .raw fields are not created

Closed this issue 10 years ago · 10 comments

I was trying to move a logstash index from a elasticsearch that is getting data from logstash to a bare ES. Data ate moving cleanly but the mapping created on target is not correct. It does not contain the .raw fields that exist in the original ES.

Without that a lot of kibana dashboard are just failing.

Answer 1 · 2014-04-25T08:17:09.000Z

Could you add the logstash mapping from the source? Makes it easier to reproduce.

I'm not actually modifying the mapping at all between fetching and writing, so I'm guessing that this is an error by ES itself, but I'll try to find out.

Answer 2 · 2014-04-25T08:51:35.000Z

Sure. Here it is:

The original: http://home.regit.org/~regit/mapping-correct
The copy: http://home.regit.org/~regit/mapping-copy

Among misc commands I have tried, I've done this:

nodejs exporter.js -h a 192.168.0.1 -b 192.168.1.132 -i logstash-2014.02.01

Answer 3 · 2014-04-28T20:28:42.000Z

How did you fetch the mapping from ES? I'm curious if there are some flags that will show a more detailed mapping then what I'm getting with the standard _mapping call.

Answer 4 · 2014-05-03T15:33:22.000Z

I've just done a simple curl on the index following ES manual (GET on _mapping).
I think you should be able to reproduce if you setup a logstash.

Answer 5 · 2014-05-03T15:34:34.000Z

Can you send me a few documents I can export, so I can reproduce it?
On May 3, 2014 8:33 AM, "Eric Leblond" notifications@github.com wrote:

I've just done a simple curl on the index following ES manual (GET on
_mapping).
I think you should be able to reproduce if you setup a logstash.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/50#issuecomment-42107872
.

Answer 6 · 2014-05-03T16:03:47.000Z

OK. Do you use lxc container? I can try to provide you one with data and a running elastic search.

Answer 7 · 2014-05-03T16:04:23.000Z

Or is data for logstash enough ?

Answer 8 · 2014-05-03T16:04:55.000Z

No, never heard of Ixc.
On May 3, 2014 9:03 AM, "Eric Leblond" notifications@github.com wrote:

OK. Do you use lxc container? I can try to provide you one with data and a
running elastic search.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/50#issuecomment-42108681
.

Answer 9 · 2014-05-03T16:06:06.000Z

Actually you can just send me 2-3 documents. I just need something in there.
On May 3, 2014 9:03 AM, "Eric Leblond" notifications@github.com wrote:

OK. Do you use lxc container? I can try to provide you one with data and a
running elastic search.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/50#issuecomment-42108681
.

Answer 10 · 2014-06-26T17:36:28.000Z

This has been unchanged for over a month. Closing this for now until more reports come in.