# Elasticsearch parse exception/Indexer failures

**URL:** <https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178>\
**Category:** Graylog Tech Challenges\
**Created:** [September 14, 2021, 8:10am UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178 "2021-09-14T08:10:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![colttt](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/colttt/32/9150_2.png) [@colttt](https://community.graylog.org/u/colttt)\
**Post date:** [September 14, 2021, 8:10am UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/1 "2021-09-14T08:10:49Z")

</div>

I’ve the following error:

```auto
ElasticsearchException[Elasticsearch exception [type=mapper_parsing_exception, reason=failed to parse field [apache_timestamp] of type [date] in document with id 'a0511820-1532-11ec-a2d4-0050568c8ce4'. Preview of field's value: 'Tue Sep 14 10:06:09.999727 2021']]; nested: ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=failed to parse date field [Tue Sep 14 10:06:09.999727 2021] with format [strict_date_optional_time||epoch_millis]]]; nested: ElasticsearchException[Elasticsearch exception [type=date_time_parse_exception, reason=Failed to parse with all enclosed parsers]];

```

does that mean, Graylog/Elasticsearch dropped the hole message? How can I figure out which server are sending logs? (In my opinion its a bug that a Log-Managementsystem is dropping(!!) logs)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 16, 2021, 1:59am UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/2 "2021-09-16T01:59:28Z")

</div>

Hello,

What is your environment, meaning what is your configuration to ingest logs and how you sending them?  
As for your error this looks like elasticsearch expects the [apache\_timestamp] field to be a date. Either you have a mapping misconfiguration, or it could be a generic ISO datetime parser, where the date must include the year at a minimum, and the time (separated by T), is optional. Examples: yyyy-MM-dd’T’HH:mm:ss.SSSZ or yyyy-MM-dd."

The [date parser](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html) defaults to strict\_date\_optional\_time or epoch\_millis.  
Did you create a template for mapping?

Edit: I did a quick google maybe this might help.

> **[Failed to parse field of type in document with id ''." - Common causes and...](https://opster.com/es-errors/failed-to-parse-field-of-type-in-document-with-id/)**
>
> A detailed guide on how to resolve errors related to "failed to parse field of type in document with id ''."

---

<div class="post-metadata">

**Author:** ![colttt](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/colttt/32/9150_2.png) [@colttt](https://community.graylog.org/u/colttt)\
**Post date:** [September 16, 2021, 9:30am UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/3 "2021-09-16T09:30:58Z")

</div>

I send logs normally via filebeat, but some “older” webserver have strange configs with something lke `|nc syslog.example.de:5514` so and it is not that easy to find them all… it would be much easier to know which IP/Source it was. it is also bad, that graylog/elastic drops this messages (for me this is a bug)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 16, 2021, 9:38pm UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/4 "2021-09-16T21:38:05Z")

</div>

Hello,

> [@colttt](#):
>
> it is also bad, that graylog/elastic drops this messages (for me this is a bug)

I feel your frustration on logs dropped. In my lab I’m testing out **Elastic-stack** , **Open Distro For Elasticsearch** → **AWS Opensearch**. Depending on the device and what logs are shipped, I run into the same problems with each of them. Sorry I cant be more help.

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [September 16, 2021, 10:20pm UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/5 "2021-09-16T22:20:13Z")

</div>

This is something we’re aware of and have a couple of issues open to address. The ideal approach is that we implement dead letter queues for elastic where we take the parts of a message that can’t be parsed and drop them

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 30, 2021, 10:20pm UTC](https://community.graylog.org/t/elasticsearch-parse-exception-indexer-failures/21178/6 "2021-09-30T22:20:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.