Problem after updating graylog version

I updated my graylog log from version 3 to version 4. However, when opening the graylog it gives the following error " While retrieving data for this widget, the following error(s) occurred:

  • Unrecognized field “properties” (class org.graylog2.indexer.fieldtypes.AutoValue_FieldTypeDTO$Builder), not marked as ignorable (2 known properties: “field_name”, “physical_type”]) at [Source: de.undercouch.bson4jackson.io.LittleEndianInputStream@404d2b38; pos: 187] (through reference chain: org.graylog2.indexer.fieldtypes.AutoValue_IndexFieldTypesDTO$Builder[“fields”]->java.util.HashSet[0]->org.graylog2.indexer.fieldtypes.AutoValue_FieldTypeDTO$Builder[“properties”])."

Does anyone know how to solve this problem?
My version of graylog is 4.0.17. elasticsearch version 6.8.23. monogodb version 4.4.18.

Hello,

From what I get in the log file.

unknown properties: “field_name”, “physical_type”

Assuming that your Widget has two fields called.

“field_name”, “physical_type”

Try rotating you indices manually see if that clears it up. Navigate to System/Indices , Click on default or custom index and in the upper right corner you should see " Maintenance" drop down box.

And/or create a new widget with correct fields.

1 Like

It worked out.

Thank you! =)

2 Likes

Hi,

This happend to me also. After upgrading one of the nodes to 4.3. It appears that during this upgrade graylog added new field “properties” for every document in index_field_types collection. Rotating all indexes that were active during this upgrade works only if they are going to be removed. If they stay open the error still persists. Unfortunately I had to downgrade to 4.2 because of problems with java 8 and ldap connections (I have to upgrade to openjdk 11 first). So I removed “properties” field directly from mongodb:

db.index_field_types.update({"fields.properties": {$exists: true}}, {$unset: {"fields.$[].properties":true}}, {multi:true})

I’ve lost 2 days on resolving this so I hope it will help someone

1 Like