Graylog indexer failure even after custom mapping

Graylog Central (peer support)
1

Hi everybody,

I’m currently facing some issues around indexer :

a few seconds ago graylog_6 9c320b90-34f8-11e9-b27d-005056953e8f {“type”:“mapper_parsing_exception”,“reason”:“failed to parse [level]”,“caused_by”:{“type”:“number_format_exception”,“reason”:“For input string: "WARN"”}}

I’ve followed all the steps http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings around creating a new index template, by adding a new graylog-custom-mapping.json with content

{
“template”: “graylog_*”,
“mappings” : {
“message” : {
“properties” : {
“level” : {
“type” : “string”
}
}
}
}
}

The idea was to overwrite the default mapping. And after loading the custom mapping and checking the resultat, the ‘level’ field is still as a long type.

Any idea? please

2

did you rotate the index after you added the new custom template?

2 Likes
3

And to add to that: you did push the custom template JSON into Elastic using Elastic’s API, right?

4

This was the last step missing on my side. It works great now!!! Thank you!

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.