0

I have inserted the following JSON document into ElasticSearch.

{
    "AppName": "undefined",
    "CPUs": 8,
    "Errors": 0,
    "Forms": 2,
    "Group": "Unknown",
    "Language": "en-GB",
    "UserName": "user.name",
    "msgType": "234",
    "bent": "{
       \"ActiveT\": 6,
        \"ErrorM\": \"None\",
        \"Except\": \"None\",
        \"HadErr\": \"false\",
        \"HM\": 62,
        \"NHM\": 57,
        \"Parameter\": \"14331232706\",
        \"ReturnCode\": \"3050\",
        \"Severity\": \"info\",
        \"Timestamp\": \"Tue July0209: 58: 16NZST2015\",
        \"TId\": \"9891319709\",
        \"UserInfo\": \"Unknown\",

    }"

}

I want be able to plot graphs using the fields that are nested inside such as HM, NHM, ActiveT etc. My structure inside elastic search is as follows.

my_indes/my_doc_type/info_id

The info is given above as the JSON document.I am using the below mapping to map the nested JSON structure bent. 

curl -XPOST localhost:9200/my_index/my_doc_type/_mapping?pretty -d '{
"events":{
        "_timestamp" : {
            "enabled" : true,
            "store" : true,
             "path" : "post_date",
            "format" : "yyyy-MM-dd HH:mm:ss"
        },
  "properties" : {
                "CPUs"  : {
                        "type" : "long",
                        "index": "not_analyzed"
                        },
                "Language"  : {
                        "type" : "string",
                        "index": "not_analyzed"
                        },
                "User"  : {
                        "type" : "string",
                        "index": "not_analyzed"
                        },

                "Forms"  : {
                        "type" : "long",
                        "index": "not_analyzed"
                        },
                "Errors"  : {
                        "type" : "long",
                        "index": "not_analyzed"
                        },
                "be_event" : {
                        "type" : "nested",
                        "properties" : {
                            "ActiveT" : { 
                                "type" : "long",  
                                "index" : "not_analyzed" 
                            },
                        }
                    }
            }
}

I get the following error.

"error" : "ElasticsearchParseException[Failed to parse content to map]; nested: JsonParseException[Unexpected character ('\"' (code 34)): was expecting comma to separate OBJECT entries\n at [Source: org.elasticsearch.common.compress.lzf.LZFCompressedStreamInput@c2f1e8d; line: 122, column: 19]]; ",
  "status" : 400

What is wrong with the mapping that I am using?

liv2hak
  • 14,472
  • 53
  • 157
  • 270
  • @Val - Can you please have a look at this question? thanks – liv2hak Jun 08 '15 at 02:02
  • 1
    the error is pretty clear, the content in the `bent` sub-structure is not valid JSON, i.e. you need to remove the backslashes so that `\"ActiveT\": 6` simply reads `"ActiveT": 6` and do the same for all other properties in that structure. Moreover, your mapping doesn't really match your document, in that 1) some properties are not named the same (`User` vs `Username`), 2) you have a dangling comma in `be_event` which makes your mapping invalid JSON as well, and 3) you're missing a closing apostrophe at the end of your POST command – Val Jun 08 '15 at 04:24

0 Answers0