# How to handle elasticsearch mapping error due to different data type
**URL:** https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885
**Category:** Graylog Central (peer support)
**Tags:** debuggingpl, pipeline-rules
**Created:** [January 22, 2018, 7:16pm UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885 "2018-01-22T19:16:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@umeshdc](https://community.graylog.org/u/umeshdc)
#### Post date: [January 22, 2018, 7:16pm UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885/1 "2018-01-22T19:16:09Z")
Hi All,
We have a message field called ‘ **status** ’ which can have either number(200) or string (‘Pending’).
Currently we are using elasicsearch dynamic mapping and due to this we are getting numberFormat exceptions whenever we have string data to status field.
Example:
When first message comes with status field value 200 to elasticsearch, it maps this field with data type as long. later after if status field get some string data then we will have numberFormat exception.
Tried below solutions,
1. We tried to change the status field mapping on elasticsearch, but unable to convert field type from long to text
2. We have looked around changing default static mapping from graylog2, but this limits us to have fixed set of fields in the log.
Please let us know for the best approach in order to solve this issue.
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [January 22, 2018, 8:33pm UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885/2 "2018-01-22T20:33:28Z")
You could use the Processing Pipelines to enforce a fixed data type for the “status” field and either convert it into the correct type or rename the field.
➡ [http://docs.graylog.org/en/2.4/pages/pipelines.html](http://docs.graylog.org/en/2.4/pages/pipelines.html)
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [January 23, 2018, 7:26am UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885/3 "2018-01-23T07:26:44Z")
use some kind of processing pipeline rule like mentioned in this posting:
> [@Howto figure out the cause of a field type conflict](https://community.graylog.org/t/howto-figure-out-the-cause-of-a-field-type-conflict/3848/2):
>
> I can think of a processing pipeline that checks the field dst\_port not beeing a number and then rename it - or write a debug log entry in the graylog server.log that contains the message source (and then delete the message). Something like the following (this is untested!) rule "dst\_port\_not\_long" when has\_field("dst\_port") AND to\_long($message.dst\_port) == 0 then rename\_field("dst\_port", "dst\_port\_nn") end
to have one status field with number and one with a string - based in the field content.
---
### Author:  [@umeshdc](https://community.graylog.org/u/umeshdc)
#### Post date: [January 24, 2018, 4:55am UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885/4 "2018-01-24T04:55:52Z")
@jochen and @jan Thanks for the quick help. This helped to fix my problem.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [February 7, 2018, 4:55am UTC](https://community.graylog.org/t/how-to-handle-elasticsearch-mapping-error-due-to-different-data-type/3885/5 "2018-02-07T04:55:59Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.