Field [winlogbeat_host_name] of type [date]

Seems like a bug. Shouldn’t this be of type [string]

Throwing constant errors: {“type”:“mapper_parsing_exception”,“reason”:“failed to parse field [winlogbeat_host_name] of type [date] in document with id ‘47f3d530-c8ec-11e9-a996-000c291b09e6’”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“Invalid format: “Ironwood””}}

Or where do I change it myself on my server?

He @Larsman

this can happen because Elasticsearch tries on ingest to detect the type of data. So if a field is created the first time - that content type is used until the next index is created.

Best option you have - force specific content types with index templates.

http://docs.graylog.org/en/3.1/pages/configuration/elasticsearch.html#custom-index-mappings

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.