https://linen.dev logo
Join Slack
Powered by
Hello, I'm looking for some help. We are using t...
# fluent-bit
d
Hello, I'm looking for some help. We are using the 
nest
and 
lift
filters and are having some issues with elasticsearch index mapping issues. It appears that sometimes the fields that are created are a JSON object and sometimes they are just a single value. For example, we are seeing this error from fluent-bit
Copy code
{"@timestamp":"2026-04-24T14:04:54.169Z","stream":"stdout","_p":"F","kubernetes":{"pod_name":"lh-cron-29617320-cj5ns","namespace_name":"pw-qa-ict-75-1005673687","pod_id":"d2323c33-d9a4-4cd9-a4af-d75f4221060d","labels": {"app":"lh-cron","azure_workload_identity/use":"true","batch_kubernetes_io/controller-uid":"7f0c7058-07fe-480d-8645-613ceadc9061","batch_kubernetes_io/job-name":"lh-cron-29617320","controller-uid":"7f0c7058-07fe-480d-  8645-613ceadc9061","job-name":"lh-cron-29617320"},"host":"aks-nodepool1-27276929-vmss0001es","container_name":"lh-cron","docker_id":"edd416842da28502d9290b302f0082969ce1a0dd18eeaf682f7910366f985723","container_image":  "<http://devbentleyhosted.azurecr.io/lakehouse-cli:25.1.0-rc.7012|devbentleyhosted.azurecr.io/lakehouse-cli:25.1.0-rc.7012>"},"kubernetes_namespace":{"name":"pw-qa-ict-75-1005673687","labels":{"azure-key-vault-env-injection":"enabled","deployment-name":"qa-ict-75","kubernetes_io/     metadata_name":"pw-qa-ict-75-1005673687","plan-id":"69e61563291229ec6d9d3bbe","purpose":"pw-qa-ict-75-1005673687","ultimate-id":"1005673687"}},"event_Timestamp":"14:04:54 ","event_EventId":0,"event_LogLevel":           "Information","event_Category":"Bentley.Providers.Lakehouse.Workers.Shepherd","event_Message":"Shepherd found that Worker is up and running.","event_State":{"{OriginalFormat}":"Shepherd found that Worker is up and      running."},"event_Scopes":[]}
 [2026/04/24 15:18:59.698751131] [error] [output:es:es.1] error: Output
 {"errors":true,"took":0,"ingest_took":0,"items":[{"create":{"_index":"dev2-cust-uksouth-logs-2026.04.24","_id":"xX0SwJ0BnywsLsf0oXtI","status":400,"error":{"type":"document_parsing_exception","reason":"[1:1260] object  mapping for [event_EventId] tried to parse field [event_EventId] as object, but found a concrete value"}}}]}
so you can see here that it's just trying to set event_EventId to 
0
but failing and I think it's because we have other events with a nested event_eventID field like so:
Copy code
"event_EventId.Id": 101,
  "event_EventId.Name": "RequestPipelineEnd",
this is the relevant config from fluent-bit:
Copy code
[FILTER]
       Name nest
       Match kube.*
       Operation lift
       Nested_under event
       Add_prefix event_
I'm a bit confused by all of this to be honest and not totally sure what the right approach is to fix this, any help would be much appreciated
we use dynamic index templates in elasticsearch (for better or worse, this is how we do it for log data) and I noticed that sometimes the index mapping for this event_eventID field looks like this:
Copy code
"event_EventId": {
          "properties": {
            "Id": {
              "type": "long"
            },
            "Name": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            }
          }
        },
and sometimes it looks like this
Copy code
"event_EventId": {
          "type": "long"
        },
why is fluent-bit not being consistent with the data for this field that it's creating?
Sorry, I'm not familiar with LUA, how does that work? Also sorry for the long delay, I went on vacation just after finding this issue. From what I can tell, the issue here is that we are running fluent-bit on both windows and linux kubernetes with the same settings but it seems like the event filter is working differently across those 2 OS with regards to this field.
I'm also still curious if there is any useful data in this event ID field, could this just be dropped?
d
The EventID is outside of the scope of Fluentbit and the question is something that should be asked to whatever is generating the log.
d
Late reply but I'm nearly sure it's fluent-bit that is creating the EventID
Sorry, I take that back. This is definitely on our side after looking into it further. I updated the bug I submitted and I closed it
2 Views
Open in Slack
PreviousNext
Powered by