Parse failure (object mapping for [trace.detail] tried to parse field [null] as object, but found a concrete value)

OpenSearch
1

Hi Team, I basically use json filter to parse log. But somewhere in json have 2 different type of log that’s why I get this error (object mapping for [trace.detail] tried to parse field [null] as object, but found a concrete value).

I found where the issue is but not able to fix it. I need support your support :slight_smile:

Problematic part of the log; ( in detail : Account not found. square brackets cause this parse error. )

“trace”: [
{
“action”: “LOGIN”,
“detail”: {
“email”: “kervan@ya.com”
},
“level”: 200,
“time”: 1687292346
},
{
“action”: “FORM_INPUTS”,
“detail”: {
“email”: “kervan@ya.com”
},
“level”: 500,
“time”: 1687292346
},
{
“action”: “LOGIN_ERROR”,
“detail”: [
“Account not found.”
],
“level”: 500,
“time”: 1687292346
}
],

I tried to split,remove this field but not able to that.

Thanks for help in advance.

2

Hey @a.emrekaraman

Can I ask what your using the json filter to parse logs? More discription would help.