Issue in eventing data to opendistro

OpenDistro
1

I was eventing ddos logs via logstash to opendistro but since 4 days i am facing the following issue.

[logstash.outputs.elasticsearch][main][dad3e60bca8c35124bf0d1e2cee7b5c780433f0042c6b38b0ff1467103ba70d5] retrying failed action with response code: 500 ({“type”=>“illegal_state_exception”, “reason”=>“invalid mapping definition, expected a single map underneath [_doc] but it was: [{properties={src_ip={type=ip}, src_port={type=integer}, packetcount={type=integer}, dstcoordinates={type=geo_point}, dest_ip={type=ip}, srccoordinates={type=geo_point}, priority={type=long}, packetbw={type=long}, errorcode={type=integer}, dest_port={type=integer}, physicalport={type=integer}}}]”})

There is an template for the index too.

What might be the issue,. how to resolve.

Thank you in advance

2

Hi @gokulswaminathan,
Could you please share your logstash pipeline, the original message, the parsed log and an example of an index log that worked fine 4 days ago?
Maybe the log format has changed, it happened to me before.