failed to parse field [kubernetes.labels.app] of type [text] in document with id

[therus000]

i got this error when try to send logs Kubernetes throw the vector to elasticsearch.
i already make and index template in elastic.

Can't get text on a START_OBJECT at 1:363\"}}}},{\"index\":{\"_index\":\"vector-2022-10-05\",\"_id\":\"-CKeqIMBTd8AVIkBXvKQ\",\"status\":400,\"error\":{\"type\":\"mapper_parsing_exception\",\"reason\":\"failed to parse field [kubernetes.labels.app] of type [text] in document with id '-CKeqIMBTd8AVIkBXvKQ'. Preview of field's value: '{kubernetes={io/component=mongod}}'\",\"caused_by\":{\"type\":\"illegal_state_exception\",\"reason\":\"Can't get text on a START_OBJECT at 1:363\"}}}},{\"index\"

[spencergilbert]

👋

Hi, this is because Elasticsearch parses keys containing . as nested json rather than literal keys app.kubernetes.io/foo.

You should either specify the mapping in Elasticsearch, rather than use dynamic mapping, or use remap to replace periods with a different character.

See for background:

• Mapping conflicts in index pattern in AWS Elasticsearch after first deployment of vector into EKS #8919
• [kubernetes_logs] Logs are not forwarded if pod has "app" label configured  #8058
• Handle dynamic field mapping with the dot notation in the elasticsearch sink #3588

[therus000]

i try this

  dedot_labels:
    type: lua
    inputs:
      - input
    version: '2'
    hooks:
      process: process
    source: |2-
          function process(event, emit)
              if event.log.kubernetes == nil then
                  return
              end
              dedot(event.log.kubernetes.pod_labels)
              emit(event)
          end

          function dedot(map)
              if map == nil then
                  return
              end
              local new_map = {}
              local changed_keys = {}
              for k, v in pairs(map) do
                  local dedotted = string.gsub(k, "%.", "_")
                  if dedotted ~= k then
                      new_map[dedotted] = v
                      changed_keys[k] = true
                  end
              end
              for k in pairs(changed_keys) do
                  map[k] = nil
              end
              for k, v in pairs(new_map) do
                  map[k] = v
              end
          end

but it not work

[spencergilbert]

If the Elasticsearch index has already set the mapping for that field, you would need to roll to a new index.