Json mapper_parsing_exception

We are using graylog to process data collected by our network security sensors.
The data is form Zeek, and used to be text fields separated by ‘|’ symbols, we used a pipeline from the marketplace to process all of thesee.
A recent upgrade has converted the logs to JSON. I have created a new input, made a JSON extractor for it, and checked it with the ‘Try’ button. Everything to that point works.

Running the input shows no data, the graylog server.log shows a “mapper_parsing_exception” trying to extract the first JSON field - a timestamp. It’s apparently trying to parse it as a float.

How do I fix this?

Ok, it’s fixed, following advice I found in this forum :grinning:

I rotated the indexes involved, and the data type sorted itself out.
I now need to check that our complicated dashboard has correct field names now.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.