Fix issue with parsing PPI Logs

[jordanpadams]

Are you sure this is not a new requirement or bug?

Yes

Task Type

Sub-task

💡 Description

"@timestamp"=>2024-01-01T11:20:54.000Z, "message"=>"IP - - [01/Jan/2024:03:20:54 -0800] \"GET /search/view?f=no&id=pds%3A%2F%2FPPI%2Fradiojove-aj4co-dps-raw-annex%2Fdata%2F2016%2F12%2F22 HTTP/1.1\" 302 0 \"-\" \"Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)\"", "timestamp"=>"01/Jan/2024:03:20:54 -0800", "@version"=>"1", "index_time"=>"2025-02-22T02:36:45.079901512Z", "organization"=>{"name"=>"ppi"}, "url"=>{"domain"=>"pds-ppi.igpp.ucla.edu", "registered_domain"=>"ucla.edu", "path"=>"/search/view", "queryparams"=>{"id"=>"pds://PPI/radiojove-aj4co-dps-raw-annex/data/2016/12/22", "f"=>"no"}, "top_level_domain"=>"edu", "original"=>"/search/view?f=no&id=pds%3A%2F%2FPPI%2Fradiojove-aj4co-dps-raw-annex%2Fdata%2F2016%2F12%2F22", "sub_domain"=>"pds-ppi.igpp", "query"=>"f=no&id=pds://PPI/radiojove-aj4co-dps-raw-annex/data/2016/12/22", "second_level_domain"=>"ucla"}}], :response=>{"index"=>{"_index"=>"en-web-analytics", "_id"=>"611542905", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [url.queryparams.f] tried to parse field [f] asobject, but found a concrete value"}}}}