Index Failures / Windows Logs

Graylog Central (peer support)
1

I am currently running into issues with Indexing windows logs. I am receiving the following error:

{“type”:“mapper_parsing_exception”,“reason”:“failed to parse field [level] of type [long] in document with id ‘073f1d77-1dbe-11ea-ad42-005056903b31’”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“For input string: “Information””}}

I know I need to create a custom index and change the data type. My question is how. This is my first foray into Graylog. Any assistance would be appreciated.

2

I had the “do not beats type as prefix” option checked on my Beats input.

Once I unchecked this, the indexing failures stopped. I will just change the way my dashboards looks for the event_id.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.