Fields show unknown type after Graylog Update from 2.4 to 3.2

Graylog Central (peer support)
1

Hi!
We updated our logging system from Graylog2.4/ES2.x to Graylog3.2/ES5.6. According to the upgrade path no ES-reindexing was done neither should it be neccessary.
Unfortunately all the log fields show type ‘unknown’ now and if new data reaches a specific field its type shows ‘compound(string,unknown)’. New Fields with only ‘fresh’ data show the correct field type.
We recognized, that at least the ‘Show top values’ function does not work with ‘unknown’ fields.
Is there - beside reindexing - any known way to solve this problem? If not, do we have to expect further troubles with the ‘unknown’ fields?

Thanks in advance and Best Regards!

2

he @ride4fun

I guess you have done the elasticsearch upgrade similar to this one?

You might find some old threads in this community that can help you with that. I can’t remember any special problems/cases for the Elasticsearch 2 to 5 update… but my last is some years back.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.