I have a “dst_port” field defined (numeric) via extractors. Works great. However, something is pushing dst_port values in as another type - causing ES errors like
[graylog_7009][1] failed to execute bulk item (index) BulkShardRequest [[graylog_7009][1]] containing [115] requests
java.lang.IllegalArgumentException: mapper [dst_port] of different type, current_type [long], merged_type [keyword]
How can I hunt down the offender? We don’t control all the inputs, so someone is probably pushing a GELF feed into us with that defined incorrectly, but how do I find it?
I can think of a processing pipeline that checks the field dst_port not beeing a number and then rename it - or write a debug log entry in the graylog server.log that contains the message source (and then delete the message).
Something like the following (this is untested!)
rule "dst_port_not_long"
when
has_field("dst_port") AND
to_long($message.dst_port) == 0
then
rename_field("dst_port", "dst_port_nn")
end
