英文:
Error adding data to Elastic from FluentD
问题
我正在尝试通过运行在Kubernetes Pod中的FluentD将数据传递给Elastic，但Elastic拒绝了带有以下消息的数据：
'无法动态添加字段[app.kubernetes.io/instance]的映射。[kubernetes.labels.app]的现有映射必须是对象类型，但找到了[text]类型。'
我尝试使用rewrite_tag插件解决此问题，但未能使任何内容正常工作。
英文:
I'm trying to pass data to Elastic via FluentD, which is running in a Kubernetes pod. Elastic is rejecting the data with the message
'Could not dynamically add mapping for field [app.kubernetes.io/instance]. Existing mapping for [kubernetes.labels.app] must be of type object but found [text].'
I've tried to resolve this using the rewrite_tag plugin but I couldn't get anything to work.
答案1
得分: 0
Tldr;
根据错误消息的建议，您的问题与当前映射以及您尝试摄取的文档有关。
似乎映射期望类似于：
{
"Kubernetes":{
"labels":{
"app":{...}
}
}
}
但您发送的文档格式如下：
{
"Kubernetes":{
"labels":{
"app": "一些文本"
}
}
}
解决方案
1. 映射是正确的
您需要将文本字段重命名/移动到其他地方，也许是在 kubernetes.labels.app.name 中。
2. 映射是错误的
您将不得不删除索引，并重新创建它，使用正确的映射。
英文:
Tldr;
As the error message suggests you have an issue with the current mapping and the document you are trying to ingest.
It seems like the mapping expect somthing like:
{
"Kubernetes":{
"labels":{
"app":{...}
}
}
}
But the document you sent was in the following format:
{
"Kubernetes":{
"labels":{
"app": "some text"
}
}
}
Solution
1. The mapping is correct
You will need to rename/move the text field in somewhere else, maybe in kubernetes.labels.app.name
2. The mapping is wrong
You will have to delete the index, an re create it with the right mapping.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论