There was a post about Graylog Indexer failure with the error similar to
Field [_timestamp] is a metadata field and cannot be added inside a document. Use the index API request parameters.
on this community forum. But, since this did not have any solution yet, I am asking this again. Anybody has any suggestions on how to go about resolving this Indexer failure issue ?Lots of Indexer failures recently
I’ve not tested this myself but could you use something like the below pipeline rule attached to correct stream. That is assuming that as with the the ticket you linked the ‘_’ is in fact ‘@’.
rule "alter field"
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.