GL 2.3.1, ES 5.5.2 unable to rotate index

Graylog Central (peer support)
1

hi,

for some reason I am unable to rotate index. The error message:

2017-09-01T08:35:04.174+03:00 INFO  [MongoIndexSet] Cycling from <graylog_1535> to <graylog_1536>.
2017-09-01T08:35:04.174+03:00 INFO  [MongoIndexSet] Creating target index <graylog_1536>.
2017-09-01T08:35:04.509+03:00 INFO  [Indices] Successfully created index template graylog-internal
2017-09-01T08:35:04.547+03:00 WARN  [Indices] Couldn't create index graylog_1536. Error: {"root_cause":[{"type":"mapper_parsing_exception","reason":"No handler for type [String] declared on field [ThreadID]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [message]: No handler for type [String] declared on field [ThreadID]","caused_by":{"type":"mapper_parsing_exception","reason":"No handler for type [String] declared on field [ThreadID]"}}
2017-09-01T08:35:04.547+03:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.RuntimeException: Could not create new target index <graylog_1536>.
        at org.graylog2.indexer.MongoIndexSet.cycle(MongoIndexSet.java:294) ~[graylog.jar:?]
        at org.graylog2.rest.resources.system.DeflectorResource.cycle(DeflectorResource.java:124) ~[graylog.jar:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_141]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_141]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_141]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_141]
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
        at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
        at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

I have the following custom field mapping:

“ThreadID” : {
“type” : “keyword”
},

And the previous index is OK:cat
> {

      "graylog_1535" : {
        "mappings" : {
          "message" : {
            "ThreadID" : {
              "full_name" : "ThreadID",
              "mapping" : {
                "ThreadID" : {
                  "type" : "keyword"
                }
              }
            }
          }
        }
      }
    }

I had problems with this right after upgrading to ES5.5, but it worked OK for a while. Now I changed the retention settings and this problem came back.

1 Like
2

Please check the existing index templates in Elasticsearch and make sure that they’re compatible with Elasticsearch 5.x.

https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-templates.html
https://www.elastic.co/guide/en/elasticsearch/reference/5.5/breaking_50_mapping_changes.html

3

interesting. The ThreadID is there twice. I wonder why…

curl -XGET …/_template/graylog*?pretty tells (I removed non-related stuff)…

{
  "graylog-custom-mapping" : {
    "order" : 0,
    "template" : "graylog_*",
    "settings" : { },
    "mappings" : {
      "message" : {
        "properties" : {
          "ConfigVersionID" : {
            "type" : "keyword"
          },
          "EventReceivedTime" : {
            "format" : "yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||strict_date_optional_time||epoch_millis",
            "type" : "date"
          },
          "ThreadID" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  },
  "graylog" : {
    "order" : 0,
    "template" : "graylog*",
    "settings" : {
      "index" : {
        "refresh_interval" : "30s"
      }
    },
    "mappings" : {
      "message" : {
        "properties" : {
          "ThreadID" : {
            "index" : "not_analyzed",
            "type" : "String"
          }
        }
      }
    },
    "aliases" : { }
  },
...

removing the template “graylog” solved this time the problem, and the index rotated. Thank you for the answer.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.