Graylog Indexer Failure - Field _timestamp is a metadata field and cannot be added inside a document

Graylog Central (peer support)
1

There was a post about Graylog Indexer failure with the error similar to

Field [_timestamp] is a metadata field and cannot be added inside a document. Use the index API request parameters.

on this community forum. But, since this did not have any solution yet, I am asking this again. Anybody has any suggestions on how to go about resolving this Indexer failure issue ?Lots of Indexer failures recently

2

Hey @hellograylog77,

I’ve not tested this myself but could you use something like the below pipeline rule attached to correct stream. That is assuming that as with the the ticket you linked the ‘_’ is in fact ‘@’.

rule "alter field"
when
  has_field("@timestamp")
then
  rename_field("@timestamp", "new_timestamp");
end
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.