I have a “dst_port” field defined (numeric) via extractors. Works great. However, something is pushing dst_port values in as another type - causing ES errors like
[graylog_7009] failed to execute bulk item (index) BulkShardRequest [[graylog_7009]] containing  requests
java.lang.IllegalArgumentException: mapper [dst_port] of different type, current_type [long], merged_type [keyword]
How can I hunt down the offender? We don’t control all the inputs, so someone is probably pushing a GELF feed into us with that defined incorrectly, but how do I find it?