Parsing failure

#1

Hi currently we have a issue about parsing here below is the json that is returned to us.

{
"type": "mapper_parsing_exception",
"reason": "failed to parse [remote_addr]",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Invalid format: "10.128.3.15" is malformed at ".128.3.15""
}
}

How can we address the problem?

Thanks

(Jochen) #2

Elasticsearch expects the “remote_addr” field to be a numeric value and not an IP address or a string.

You could create a pipeline rule which ensures that the “remote_addr” field has always the same datatype and create a custom Elasticsearch index mapping:

http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings

(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.