JSON Parse Failure on host Field (could not set field 'ip' on object)

[andriilahuta]

Due to the conflict with ECS spec, the messages can't be properly parsed in newer logstash versions.
Here's more info in a similar issue: vklochan/python-logstash#106

[eht16]

Yes, the formatter classes do not support the ECS spec.
There are a few options:

• disable the ECS validation on Logstash (see the documentation for setting pipeline.ecs_compatibility and adjust your index pattern accordingly
• override the formatter class to pass the Logstash event as it is expected

I'd happily accept a new formatter class which is compatible with the ECS spec but I won't work on this myself.

[eht16]

This is a duplicate of #39.

See also my comment #39 (comment) about using a mutate filter in Logstash to modify the event.