Good morning everyone
I wanted to ask for support in identifying and resolving the cause of errors I receive in Indexer Failures
The error is as follows:
** 1.
ElasticsearchException [Elasticsearch exception [type = illegal_argument_exception, reason = mapper [v] cannot be changed from type [date] to [keyword]]]
The machine is installed on the Virtualbox 6.1.38 virtual platform
Installed for a month, it has never presented errors to date
From this morning I receive the report highlighted in point ** 1
No particular settings have been made with respect to the basic installation except to customize ram and cpu for JAVA
As I read the error message, you are trying to ingest something into a field of type timestamp which is a keyword and not a timestamp.
Elastic guesses the type of a field (if not configured) by the first arriving message after a rotation of an index. I would assume, that your index rotated and one filed looked (at least for elastic) somehow like a timestamp. Some of your following messages where not, so elastic didn’t take them.
To fix the behavior read the section “Custom index mappings” in the Graylog docs.
As a quick fix you might rotate your index and hope the first message is of type keyword again.
