Indexer failures-IllegalArgumentException

Graylog Central (peer support)
1

Hi All,
we have this errors in Indexer failures:

MapperParsingException[failed to parse [stime]]; nested: IllegalArgumentException[Invalid format: "03/Mar/2017:16:22:57 +0100" is malformed at "/Mar/2017:16:22:57 +0100"];
MapperParsingException[failed to parse [stime]]; nested: IllegalArgumentException[Invalid format: "03/Mar/2017:16:22:56 +0100" is malformed at "/Mar/2017:16:22:56 +0100"];
MapperParsingException[failed to parse [stime]]; nested: IllegalArgumentException[Invalid format: "Mar 3 16:22:56"];
MapperParsingException[failed to parse [stime]]; nested: IllegalArgumentException[Invalid format: "Mar 3 16:22:57"];

Is it possible to find source of these messages?
could you give me some advice for this error?
thanks

2

Hey @lubos,

sadly, there currently is no real way to find out in which Input an indexer fail occurred.
I had this error some time ago. I’ll look up what I changed to fix it when I’m at work :slight_smile:

Greetings - Phil

3

Elasticsearch thinks that the stime field should be a valid date (because of the dynamic mapping if no custom mapping was provided).

Consider creating a custom index mapping for the stime field with the correct type: http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html#custom-index-mappings

1 Like