We just set up a new Graylog cluster at UD and we are having a repeating problem of about 71,300 or so indexer failures almost every day or so. The errors don’t make much sense compared to the similar errors I’ve seen in the forums, mainly because they are all parser errors on [application_name] of type [date] similar to this:
ElasticsearchException[Elasticsearch exception [type=mapper_parsing_exception, reason=failed to parse field [application_name] of type [date] in document with id '05beac84-97bc-11eb-8f17-0010e079a20a'. Preview of field's value: 'xinetd']]; nested: ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=failed to parse date field [xinetd] with format [strict_date_optional_time||epoch_millis]]]; nested: ElasticsearchException[Elasticsearch exception [type=date_time_parse_exception, reason=date_time_parse_exception: Failed to parse with all enclosed parsers]];
The id doesn’t appear to be of help since the messages never make it into ES (so I can’t go see the message it’s complaining about).
Any ideas how to track these down?