# Mapper parsing exceptions after migration to OpenSearch

**URL:** <https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777>\
**Category:** Graylog Central (peer support)\
**Created:** [September 19, 2022, 8:57pm UTC](https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777 "2022-09-19T20:57:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hangstl](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@hangstl](https://community.graylog.org/u/hangstl)\
**Post date:** [September 19, 2022, 8:57pm UTC](https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777/1 "2022-09-19T20:57:17Z")

</div>

Graylog: 4.3.7  
OpenSearch: 1.3.5

After the migration from ElasticSearch to OpenSearch I get lots of mapper parsing exceptions (“failed to parse field [level] of type [long]”):

`... [317]: index [graylog_5266], type [_doc], id [9b6c2f86-3849-11ed-9071-0242775af1e6], message [ElasticsearchException[Elasticsearch exception [[338]: index [graylog_5266], type [_doc], id [9b6ca4b0-3849-11ed-9071-0242775af1e6], message [ElasticsearchException[Elasticsearch exception [type=mapper_parsing_exception, reason=failed to parse field [level] of type [long] in document with id '9b6ca4b0-3849-11ed-9071-0242775af1e6'. Preview of field's value: 'INFO']]; nested: ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=For input string: "INFO"]];] ...`

When I do a “Show top values” I get lots of different values for “level”. So it seems some messages go into OpenSearch, and some cause issues. But I don’t get why.

Please help.

 ![top](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/893dff6bde88079e77b02f3ea6741ffed0abc0b7.png)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 19, 2022, 11:55pm UTC](https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777/2 "2022-09-19T23:55:27Z")

</div>

Hello @hangstl

I’ve seen this issue before here, Some how, some way your field “level” was set to something different. Only a few ways I know how to solve this.

- Check elasticsearch and correct it to type “long”.
- Create a new index and send log to that one.

Here is an example of of checking fro field “LEVEL” type.

```auto
[root@graylog graylog_user]# curl -XGET http://localhost:9200/graylog_1723/_mapping/field/level?pretty
{
  "graylog_1723" : {
    "mappings" : {
      "level" : {
        "full_name" : "level",
        "mapping" : {
          "level" : {
            "type" : "long"
          }
        }
      }
    }
  }
}
[root@graylog graylog_user]#

```

---

<div class="post-metadata">

**Author:** ![H2Cyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h2cyber/32/12536_2.png) [@H2Cyber](https://community.graylog.org/u/H2Cyber)\
**Post date:** [September 20, 2022, 8:07pm UTC](https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777/3 "2022-09-20T20:07:46Z")

</div>

Here are two related feature requests, please upvote over in Github for more visibility :

- [Visual indicator of where fields are used · Issue #13479 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/issues/13479)
- [Manage field types (custom mappings) via Graylog UI · Issue #13480 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/issues/13480)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 4, 2022, 8:08pm UTC](https://community.graylog.org/t/mapper-parsing-exceptions-after-migration-to-opensearch/25777/4 "2022-10-04T20:08:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.