Hey all,
Since most of the old topics are closed - I just wanted to share my little guide after troubleshooting a mapper_parse_exception. First - the information at http://docs.graylog.org/en/3.1/pages/indexer_failures.html is spot-on as usual but for the extra nudge I wrote (in my completely informal style) how I personally troubleshoot something like:
{"type":"mapper_parsing_exception","reason":"failed to parse field [rt] of type [date] in document with id '67b4e3f0-cb49-11e9-815d-005056aed827'","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: \"Aug 30 2019 13:12:29 GMT-04:00\""}}
Basically:
- Force the index type
- Find the guilty message
- Fix
Read here (External Blog)