opensearch error ink{component_kind="sink" component_id=es_cluster component_type=elasticsearch component_name=es_cluste

[9xalex]

[sources.my_docker_logs_source]
type = "docker_logs"
docker_host ="/var/run/docker.sock"
include_containers = [ "include_","xxxx"]

Parse Syslog logs

See the Vector Remap Language reference for more info: https://vrl.dev

Print parsed logs to stdouti

#[sinks.out]
#inputs = ["json_parser"]
#type = "console"
#encoding.codec = "json"

[transforms.json_parser]
type = "json_parser"
inputs = ["my_docker_logs_source"]
drop_field = true

[sinks.es_cluster]
type = "elasticsearch"
inputs = [ "my_docker_logs_source"]
endpoint = "https://sxxxxx"
healthcheck = false
auth.strategy = "basic"
auth.user = "admin"
auth.password = "xxxxxxx"

Vector's GraphQL API (disabled by default)

Uncomment to try it out with the vector top command or

in your browser at http://localhost:8686

#[api]

---- ERROR --
Jan 20 11:01:04 ip-10-82-53-212.ap-southeast-1.compute.internal vector[26413]: 2022-01-20T11:01:04.352245Z ERROR sink{component_kind="sink" component_id=es_cluster component_type=elasticsearch component_name=es_cluster}:request{request_id=330}: vector::sinks::elasticsearch::service: Response contained errors. response=Response { status: 200, version: HTTP/1.1, headers: {"date": "Thu, 20 Jan 2022 11:01:04 GMT", "content-type": "application/json; charset=UTF-8", "content-length": "1018", "connection": "keep-alive", "access-control-allow-origin": "*"}, body: b"{"took":6,"errors":true,"items":[{"index":{"_index":"vector-2022.01.20","_type":"_doc","_id":"77cld34BScMf1AAkqgHY","status":400,"error":{"type":"illegal_argument_exception","reason":"can't merge a non object mapping [label.com.docker.compose.project] with an object mapping"}}},{"index":{"_index":"vector-2022.01.20","_type":"_doc","_id":"8Lcld34BScMf1AAkqgHY","status":400,"error":{"type":"illegal_argument_exception","reason":"can't merge a non object mapping [label.com.docker.compose.project] with an object mapping"}}},{"index":{"_index":"vector-2022.01.20","_type":"_doc","_id":"8bcld34BScMf1AAkqgHY","status":400,"error":{"type":"illegal_argument_exception","reason":"can't merge a non object mapping [label.com.docker.compose.project] with an object mapping"}}},{"index":{"_index":"vector-2022.01.20","_type":"_doc","_id":"8rcld34BScMf1AAkqgHY","status":400,"error":{"type":"illegal_argument_exception","reason":"can't merge a non object mapping [label.com.docker.compose.project] with an object mapping"}}}]}" }

[spencergilbert]

This is due to Elasticsearch index mappings, see #8058 (comment) for more details on how to handle this from the Vector side.

[9xalex]

Thanks. tried with another method, removed error fields.