# Issues after upgrading to 3.0.0

**URL:** <https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324>\
**Category:** Graylog Central (peer support)\
**Created:** [March 7, 2019, 11:20pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324 "2019-03-07T23:20:30Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![limeman38](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@limeman38](https://community.graylog.org/u/limeman38)\
**Post date:** [March 7, 2019, 11:20pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/1 "2019-03-07T23:20:30Z")

</div>

Hello,

I had previously been on version 2.6. I have gone though the steps of setting up new elasticsearch 6.x nodes and doing the remote reindex from my 5.x elasticsearch nodes. Cluster health shows that the index(s) are good. However when I start I see the following in my logs:

`Fielddata is disabled on text fields by default. Set fielddata=true on [timestamp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.Fielddata is disabled on text fields by default. Set fielddata=true on [timestamp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. (ElasticsearchException)`

I have tried to follow:

[http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings)

To create a custom field mapping but that yields this error:

```
{

```

“error” : {  
“root\_cause” : [  
{  
“type” : “mapper\_parsing\_exception”,  
“reason” : “No handler for type [string] declared on field [http\_method]”  
}  
],  
“type” : “mapper\_parsing\_exception”,  
“reason” : “Failed to parse mapping [message]: No handler for type [string] declared on field [http\_method]”,  
“caused\_by” : {  
“type” : “mapper\_parsing\_exception”,  
“reason” : “No handler for type [string] declared on field [http\_method]”  
}  
},  
“status” : 400  
}

I am at a lose for how to fix this.

---

<div class="post-metadata">

**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\
**Post date:** [March 8, 2019, 7:23am UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/2 "2019-03-08T07:23:00Z")

</div>

We’re missing the one essential element here, your custom field mapping 😉 Could you paste it here so we can see what you tried to do?

---

<div class="post-metadata">

**Author:** ![limeman38](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@limeman38](https://community.graylog.org/u/limeman38)\
**Post date:** [March 8, 2019, 5:52pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/3 "2019-03-08T17:52:57Z")

</div>

How do I supply this information to you followin this document:

[http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings)

When I try to do the mapping suggested it complains about the string type specified:

“http\_method” : {  
“type” : “string”,  
“index” : “not\_analyzed”  
},

Is this syntax not correct?

I think this is what you are asking for:

nclark@nclark:~$ curl -X GET '[http://vroomfondel:9200/](http://vroomfondel:9200/)_template/graylog-internal?pretty’  
{  
“graylog-internal” : {  
“order” : -1,  
“index\_patterns” : [  
"graylog__"  
],  
“settings” : {  
“index” : {  
“analysis” : {  
“analyzer” : {  
“analyzer\_keyword” : {  
“filter” : “lowercase”,  
“tokenizer” : “keyword”  
}  
}  
}  
}  
},  
“mappings” : {  
“message” : {  
“properties” : {  
“message” : {  
“type” : “text”,  
“analyzer” : “standard”,  
“fielddata” : false  
},  
“full\_message” : {  
“type” : “text”,  
“analyzer” : “standard”,  
“fielddata” : false  
},  
“timestamp” : {  
“type” : “date”,  
“format” : “yyyy-MM-dd HH:mm:ss.SSS”  
},  
“source” : {  
“type” : “text”,  
“analyzer” : “analyzer\_keyword”,  
“fielddata” : true  
},  
“streams” : {  
“type” : “keyword”  
}  
},  
“dynamic\_templates” : [  
{  
“internal\_fields” : {  
“match” : "gl2\__",  
“mapping” : {  
“type” : “keyword”  
}  
}  
},  
{  
“store\_generic” : {  
“match\_mapping\_type” : “string”,  
“mapping” : {  
“type” : “keyword”  
}  
}  
}  
],  
“\_source” : {  
“enabled” : true  
}  
}  
},  
“aliases” : { }  
}  
}

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 11, 2019, 10:11am UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/4 "2019-03-11T10:11:52Z")

</div>

if would you would format your posting like mentioned in the FAQ: [https://community.graylog.org/faq#format-markdown](https://community.graylog.org/faq#format-markdown) it is more likely that someone is able to help you in his spare time …

---

<div class="post-metadata">

**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\
**Post date:** [March 11, 2019, 9:46pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/5 "2019-03-11T21:46:01Z")

</div>

Alternatively throw it on pastebin and paste the link here 🙂 Easier to read when something is properly formatted 😃

---

<div class="post-metadata">

**Author:** ![limeman38](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@limeman38](https://community.graylog.org/u/limeman38)\
**Post date:** [March 12, 2019, 2:43pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/7 "2019-03-12T14:43:29Z")

</div>

All I am looking for is the correct way to create the graylog-custom-mapping.json.

I tried as it says in [http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings)

```auto
nclark@nclark:~$ curl -X GET 'http://vroomfondel:9200/template/graylog-internal?pretty’

```

It outputs the following:

```auto
“error” : {
“root_cause” : [
{
“type” : “mapper_parsing_exception”,
“reason” : “No handler for type [string] declared on field [http_method]”
}
],
“type” : “mapper_parsing_exception”,
“reason” : “Failed to parse mapping [message]: No handler for type [string] declared on field [http_method]”,
“caused_by” : {
“type” : “mapper_parsing_exception”,
“reason” : “No handler for type [string] declared on field [http_method]”
}
},
“status” : 400
}

```

I do not think there is a field type of string anymore in elasticsearch 6.x. I am not sure how to update this to work. I got it all to mostly work by removing indexes I moved in from 2.x elasticsearch. Though my AWS plugin will not work and spits out the same error message about field index.

---

<div class="post-metadata">

**Author:** ![limeman38](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@limeman38](https://community.graylog.org/u/limeman38)\
**Post date:** [March 13, 2019, 9:49pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/8 "2019-03-13T21:49:55Z")

</div>

Well I ended up just removing all the index(s) I transferred in from the older elasticsearch and those messages have disappeared.

I guess we can just close this post

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 27, 2019, 9:49pm UTC](https://community.graylog.org/t/issues-after-upgrading-to-3-0-0/9324/9 "2019-03-27T21:49:58Z")

</div>

Closed on March 27, 2019, 9:49pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.