Problem after updating graylog version

Graylog Central (peer support)
1

I updated my graylog log from version 3 to version 4. However, when opening the graylog it gives the following error " While retrieving data for this widget, the following error(s) occurred:

  • Unrecognized field “properties” (class org.graylog2.indexer.fieldtypes.AutoValue_FieldTypeDTO$Builder), not marked as ignorable (2 known properties: “field_name”, “physical_type”]) at [Source: de.undercouch.bson4jackson.io.LittleEndianInputStream@404d2b38; pos: 187] (through reference chain: org.graylog2.indexer.fieldtypes.AutoValue_IndexFieldTypesDTO$Builder[“fields”]->java.util.HashSet[0]->org.graylog2.indexer.fieldtypes.AutoValue_FieldTypeDTO$Builder[“properties”])."

Does anyone know how to solve this problem?
My version of graylog is 4.0.17. elasticsearch version 6.8.23. monogodb version 4.4.18.

2

Hello,

From what I get in the log file.

unknown properties: “field_name”, “physical_type”

Assuming that your Widget has two fields called.

“field_name”, “physical_type”

Try rotating you indices manually see if that clears it up. Navigate to System/Indices , Click on default or custom index and in the upper right corner you should see " Maintenance" drop down box.

And/or create a new widget with correct fields.

3

It worked out.

Thank you! =)

4

Hi,

This happend to me also. After upgrading one of the nodes to 4.3. It appears that during this upgrade graylog added new field “properties” for every document in index_field_types collection. Rotating all indexes that were active during this upgrade works only if they are going to be removed. If they stay open the error still persists. Unfortunately I had to downgrade to 4.2 because of problems with java 8 and ldap connections (I have to upgrade to openjdk 11 first). So I removed “properties” field directly from mongodb:

db.index_field_types.update({"fields.properties": {$exists: true}}, {$unset: {"fields.$[].properties":true}}, {multi:true})

I’ve lost 2 days on resolving this so I hope it will help someone

5

@xsi,. I also upgraded just one graylog node to 4.3 (others are 4.0.17) and I noticved in GUI-s under nodes, that the upgraded node did not show up on the list of nodes , as shown by cluster master. I assume this is because of different version than the rest of cluste. After downgrade back to 4.0.17 it showed there again. Did you noticed similar state after upgrade of just 1 node ?