Mapping error on field that does not exist

Graylog Central (peer support)
1

ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=mapper [latencies] cannot be changed from type [long] to [float]]]
Is the error I am getting. The problem here is, there is no field called “latencies” or “latency” in my data. I searched both with “_exists:”
And I only got a result for “latency”, but in the wrong index. (Not just generation, entirely different definition, also there they are already float)

So I assume it is something elasticsearch internal but I also could not find any reference to that. Any ideas?

2

Hey @daniel2,

Can you see that field when checking the mappings of the index, is it potentially being set within a template in Elastic?

curl -XGET 192.168.66.3:9200/_template/your_index?=pretty
curl -XGET 192.168.66.3:9200/graylog_136/_mapping?=pretty

3

Hello,
You don’t find your log in Graylog because when this errors happens the log is just dropped.
So you need to check your logs before they arrive in Graylog.

4

curl -XGET 192.168.66.3:9200/_template/your_index?=pretty

I can not figure out which parameter this one expects. I tried prefix + generation and just the prefix. Both just give “{ }”

curl -XGET 192.168.66.3:9200/graylog_136/_mapping?=pretty

Adjusted for my data gives me a plausible result with no mention of latencies.

searched in nano: “[ “latencies” not found ]”

I also confirmed that I got “lucky” and the message popped up again a few times during the last few days. “lucky” because the last potential hints where almost rotated out by now. So I can be sure that the filed should still exist in a fairly recent index.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.