title: How can I parse plain text log following ECS (elastic common schema) with logstash?
body: <p>I am using rsyslog to send plain text log to logstash. But I cannot assign data to host.name or host.ip fields by grok. The system through following error:</p>
  <blockquote>
  <p>Could not index event to Elasticsearch. {:status=&gt;400, :action=&gt;[&quot;index&quot;, {:_id=&gt;nil, :_index=&gt;&quot;logstash-syslog-2020.09.03&quot;, :routing=&gt;nil, :_type=&gt;&quot;_doc&quot;}, #LogStash::Event:0x3273b8c], :response=&gt;{&quot;index&quot;=&gt;{&quot;_index&quot;=&gt;&quot;logstash-syslog-2020.09.03&quot;, &quot;_type&quot;=&gt;&quot;_doc&quot;, &quot;_id&quot;=&gt;&quot;i2hRU3QBeWqyaoMf1lgh&quot;, &quot;status&quot;=&gt;400, &quot;error&quot;=&gt;{&quot;type&quot;=&gt;&quot;mapper_parsing_exception&quot;, &quot;reason&quot;=&gt;&quot;Could not dynamically add mapping for field [host.ip]. Existing mapping for [host] must be of type object but found [text].&quot;}}}}</p>
  </blockquote>
  <p>I tried with [host][name] but had an error message:</p>
  <blockquote>
  <p>Grok regexp threw exception {:exception=&gt;&quot;Could not set field 'name' on object '' to value ''.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string&quot; ...</p>
  </blockquote>
  <p>Here is grok configuration:</p>
  <pre><code>grok {
    match =&gt; { &quot;message&quot; =&gt; &quot;&lt;%{INT:log.syslog.priority}&gt;%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host.name} %{DATA:process.name}(?:\[%{POSINT:process.pid}\])?: %{GREEDYDATA:syslog_message}&quot; }
  }
  </code></pre>
  <p>My purpose is to parsing log messages according to ECS standard so that SIEM app can analyze these logs.</p>