[
https://issues.apache.org/jira/browse/LOG4J2-2139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16277339#comment-16277339
]
Daniel Kirkdorffer commented on LOG4J2-2139:
--------------------------------------------
[~mikaelstaldal] - The problem is that before our Kibana instance started
ingesting our JSONLayout data that included locationInfo and "source" Objects,
it had previously ingested data from other systems that included "source"
Strings. It appears that once Kibana becomes aware of a new key name it fixes
the type, so that when it suddenly came across the new "source" Objects it
expected Strings and couldn't parse the data with the following error:
{code}{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "failed to parse [source]"
}
],
"type": "mapper_parsing_exception",
"reason": "failed to parse [source]",
"caused_by": {
"type": "illegal_state_exception",
"reason": "Can't get text on a START_OBJECT at 1:905"
}
},
"status": 400
}{code}
> JSONLayout ability to rename keys in log output - particularly locationInfo
> "source"
> ------------------------------------------------------------------------------------
>
> Key: LOG4J2-2139
> URL: https://issues.apache.org/jira/browse/LOG4J2-2139
> Project: Log4j 2
> Issue Type: Improvement
> Components: Layouts
> Reporter: Daniel Kirkdorffer
> Priority: Minor
> Labels: json
>
> We ran into a problem when setting {{locationInfo}} to {{true}} when
> ingesting logs into Kibana. The problem had to do with a conflict with
> another existing key named {{"source"}} of type String, and the fact that
> {{locationInfo}} produces an Object called "source".
> So it would be nice to have a way to supply a different Object name. Perhaps
> this could be broadened so that other key names could also be renamed?
> Maybe there is a way to do this already?
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
