Graylog metrics plugin feeding data via GELF to Graylog causing parsing errors

Thanks!

feeding graylog data back into the same graylog will/might kill that environment quickly.
Once you have problems/high load you maximise the problems you might see …

I know, already working on a proper solution but we needed to look into some issues right now :wink:

But for the error - you have a field (value) that is create as type long (because a long was the first ingested data for this field after index creation) and you try to ingest other data into that.

That is what I figured but I was unable to find the cause.
Seems like I somehow sampled every single message except the two types that cause issues :see_no_evil: :man_shrugging:

I checked out whether to force the type to text but that is troublesome as it prohibits me from doing proper statistics on the values.
In the end I went with a pipeline that just renames the field for the offending metrics which is good enough until we switch to feeding the metrics into another system

For completenes sake:

Rule "Cleanup: Rename oldest-segment metrics value field"
when
    has_field("name") AND
    has_field("value") AND
    to_string($message.name) == "org.graylog2.journal.oldest-segment"
then
    rename_field(
        old_field: "value",
        new_field: "value_string"
    );
end