# Constraining few objects in opensearchn

**URL:** <https://forum.opensearch.org/t/constraining-few-objects-in-opensearchn/11134>\
**Category:** Index Management\
**Created:** [October 4, 2022, 12:37pm UTC](https://forum.opensearch.org/t/constraining-few-objects-in-opensearchn/11134 "2022-10-04T12:37:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![schand](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@schand](https://forum.opensearch.org/u/schand)\
**Post date:** [October 4, 2022, 12:37pm UTC](https://forum.opensearch.org/t/constraining-few-objects-in-opensearchn/11134/1 "2022-10-04T12:37:55Z")

</div>

Hello

I am having issue with mapper\_parsing. Error states that, ““reason”=\>“object mapping for [kubernetes.labels.app] tried to parse field [app] as object, but found a concrete value”}”. Because of this, alot of the logs aren’t being pushed to OpenSearch.

ERROR:  
“2022-10-04 03:04:53 +0000 [error]: #0 [out\_os] Could not push log to Elasticsearch: {“took”=\>4, “errors”=\>true, “items”=\>[{“index”=\>{”\_index"=\>“”, “\_type”=\>“\_doc”, “\_id”=\>“hGn0oIMB7e53OWfmE5-p”, “status”=\>400, “error”=\>{“type”=\>“mapper\_parsing\_exception”, “reason”=\>“object mapping for [kubernetes.labels.app] tried to parse field [app] as object, but found a concrete value”}}}, {“index”=\>{“\_index”=\>“”, “\_type”=\>“\_doc”, “\_id”=\>“hWn0oIMB7e53OWfmE5-p”, “status”=\>400, “error”=\>{“type”=\>“mapper\_parsing\_exception”, “reason”=\>“object mapping for [kubernetes.labels.app] tried to parse field [app] as object, but found a concrete value”}}}, {“index”=\>{“\_index”=\>“”, “\_type”=\>“\_doc”, “\_id”=\>“hmn0oIMB7e53OWfmE5-p”, “status”=\>400, “error”=\>{“type”=\>“mapper\_parsing\_exception”, “reason”=\>“object mapping for [kubernetes.labels.app] tried to parse field [app] as object, but found a concrete value”}}}]}"

I have tried couple of things.  
1.tried to rename the key name from fluentd to “rename\_key” → did not work

```auto
<filter kubernetes.var.log.containers.**.log>
@type rename_key
enable_ruby true
rename_rule1 cdn-proxy-(.+) cdn-proxy
rename_rule2 (\s.+) input
</filter>

```

1. tried to remove all the key names conflicting with the “kubernetes.labels.app” like “[kubernetes.labels.app.kubernetes.io/instance,kubernetes.labels.app.kubernetes.io/managed-by,kubernetes.labels.app.kubernetes.io/name](http://kubernetes.labels.app.kubernetes.io/instance,kubernetes.labels.app.kubernetes.io/managed-by,kubernetes.labels.app.kubernetes.io/name)…”. but, then all the logs from the application got stopped

```auto
<filter pattern>
  @type record_modifier

  # remove key1 and key2 keys from record
  remove_keys key1,key2
</filter>

```

1. From Dev tools, tried creating templates like this:

```auto
PUT _index_template/celia-template
{
  "index_patterns": [
    "index-pattern*"
  ],
  "template": {
    "mappings": {
      "properties": {
        "kubernetes.labels.app": {
          "type": "object"
        }
      }
    }
  },
  "priority": 200,
  "version": 3,
  "_meta": {
    "description": "using component templates"
  }
}

```

4.Tried to ingest pipe line:

```auto
PUT _ingest/pipeline/my_rename_pipeline
{
  "description" : "describe pipeline",
  "processors" : [
    {
      "rename": {
        "field": "fieldCamelcase",
        "target_field": "fieldCamelCase"
      }
    }
  ]
}

```

None of the options helped me. Could anyone please let me know, if there is any option for blocking certain objects(key-value pairs) or overcoming this issue for logs from kubernetes to OpenSearch via fluentd and get remaining part of the logs.

Thank you in advance

---

<div class="post-metadata">

**Author:** ![tru64jurus](https://avatars.discourse-cdn.com/v4/letter/t/85e7bf/32.png) [@tru64jurus](https://forum.opensearch.org/u/tru64jurus)\
**Post date:** [January 10, 2023, 3:03am UTC](https://forum.opensearch.org/t/constraining-few-objects-in-opensearchn/11134/2 "2023-01-10T03:03:22Z")

</div>

I am having same exact issue. Appreciate any help.

My setup fluentbit —\> fluentd —\> kafka \<---- Logstash pulls logs and send it to —\> OpenSearch

Error:  
“status”=\>400, “error”=\>{“type”=\>“mapper\_parsing\_exception”, “reason”=\>“Co]. Existing mapping for [kubernetes.labels.app] must be of type object but found [text].”}}}}

---

<div class="post-metadata">

**Author:** ![Mr\_Hedgehog](https://avatars.discourse-cdn.com/v4/letter/m/74df32/32.png) [@Mr\_Hedgehog](https://forum.opensearch.org/u/Mr_Hedgehog)\
**Post date:** [December 1, 2023, 11:16am UTC](https://forum.opensearch.org/t/constraining-few-objects-in-opensearchn/11134/3 "2023-12-01T11:16:11Z")

</div>

Was there any resolution or work around to this issue? I am having the exact same problem now. Thanks.