# Expected numeric type on field \[Application\], but got \[keyword\]

**URL:** <https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483>\
**Category:** Graylog Central (peer support)\
**Created:** [March 15, 2019, 8:42pm UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483 "2019-03-15T20:42:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![camilla-m](https://avatars.discourse-cdn.com/v4/letter/c/8491ac/32.png) [@camilla-m](https://community.graylog.org/u/camilla-m)\
**Post date:** [March 15, 2019, 8:42pm UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483/1 "2019-03-15T20:42:22Z")

</div>

Hi everybody!

After created a Stream with a rule that in the field Application I receive a keyword called “Corridas”, I started to get a lot of errors like this in the Elastic Search logs:

Caused by: java.lang.IllegalArgumentException: Expected numeric type on field [Application], but got [keyword]

So how can I use a filter/rule that I can only receive in a field things related with a word x?

Thank you

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 16, 2019, 9:46am UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483/2 "2019-03-16T09:46:15Z")

</div>

you can

- create a custom mapping that forces a specific field type that matches the content
- you write a processing pipeline that writes numbers in one field “application\_num” and strings in “application\_keyword”

both are possible and highly depends what you like todo with the data.

---

<div class="post-metadata">

**Author:** ![camilla-m](https://avatars.discourse-cdn.com/v4/letter/c/8491ac/32.png) [@camilla-m](https://community.graylog.org/u/camilla-m)\
**Post date:** [March 22, 2019, 6:08pm UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483/3 "2019-03-22T18:08:11Z")

</div>

Is there a way that I can just deny the user to search some keywords, even it’s in All Messages Stream?  
Is just with streams that I can deal with permissions to a user?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 23, 2019, 9:02am UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483/4 "2019-03-23T09:02:11Z")

</div>

no - you do not have such an option

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 6, 2019, 9:02am UTC](https://community.graylog.org/t/expected-numeric-type-on-field-application-but-got-keyword/9483/5 "2019-04-06T09:02:11Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.