Grok patterns not able to parse numbers after index rotation

[Totally_Not_A_Robot (Tess)]

@emanzaman

and suddenly Elasticsearch started complaining that there is a conflict of field type for the older and the new index.

I’ve had run-ins with this situation too, leading to excessive amounts of indexing failures. One of the ways to force field types is by using “templates” in ElasticSearch. For example, here’s my topic where I had indexing issues:

Winlogbeat templates not included?

Hey guys, I’m mostly rubber-duckying here, apologies if the thread is mostly me answering my own questions… Situation Last week our Graylog cluster was puttering along just fine, everything fine and dandy. This morning, I come in to find no less than 38k indexer failures on the System > Overview. Troubleshooting The indexer failures details tell me that all of the errors revolve around one issue: type: mapper_parsing_exception, reason: failed to parse [winlogbeat_event_data_param2], cause …

And its follow-up

Winlogbeat templates for Elasticsearch not complete?

Wouldn’t you know it? Exactly two weeks after my previous thread, the same issue arises again. And I’m two hours too late to necro the previous thread. This weekend the indices rotated and I’m back to looking at 18k indexing failures. And like before, it revolves around the “winlogbeat_event_data_param2” field, which is incorrectly typed in the new index. I know. I was dumb. I should not have assumed that the Winlogbeat template for Elastic was actually complete. Turns out that the “winlogbe…

The problems I describe are not the same as the ones you’re experiencing. I’m linking the two topics as an example of how I enforced field types with templates.