# Problem Rancher Logging - JSON

**URL:** <https://forums.suse.com/t/problem-rancher-logging-json/17729>\
**Category:** General\
**Created:** [June 15, 2020, 1:56pm UTC](https://forums.suse.com/t/problem-rancher-logging-json/17729 "2020-06-15T13:56:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![MartinGWVS](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@MartinGWVS](https://forums.suse.com/u/MartinGWVS)\
**Post date:** [June 15, 2020, 1:56pm UTC](https://forums.suse.com/t/problem-rancher-logging-json/17729/1 "2020-06-15T13:56:30Z")

</div>

Hello,

i`m using the logging feature now for a while i send the logs to an elasticseach cluster. Everything worked fine so far. Now i have enabled the “Enable JSON Parsing” because our Developers want to log in json format. But now i get an error if the following json gets logged.

{"@timestamp":“2020-06-03T14:08:17.429Z”, “log.level”: “WARN”, “message”:"Authentication event AuthenticationFailureBadCredentialsEvent: …}

The Error is this one:  
error\_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error=“400 - Rejected by Elasticsearch” [error type]: mapper\_parsing\_exception [reason]: 'Could not dynamically add mapping for field [log.level]. Existing mapping for [log] must be of type object but found [text]

Is there a way that i get these messages correctly send to elasticsearch?

On elasticsearch i have enabled dynamic mapping. I tried to modify the mapping but i think then all the other rancher logs will not be sent correctly.

Is there anything i can do on the rancher side?

Thank you for your help and feedback.

Regards,  
Martin