I got error while parsing a log entry. I tried to look for the message using the message lookup but i couldn’t find this particular message causing the problem to my extractors (using Message ID as 75600dd0-57b0-11e8-a044-000c299fd582 and graylog_0 as the index). Any idea how i can get it without trying to dig back on my servers logs?
Thanks in advance…
Mohamed
message
Failed to index message: index=<graylog_0> id=<75600dd0-57b0-11e8-a044-000c299fd582> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_time]","caused_by":{"type":"number_format_exception","reason":"For input string: \"Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET4.0C;+.NET4.0E;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729)\""}}>
The message wasn’t indexed, so you won’t be able to find it.
The error message says, that the “response_time” field is expected to be a number but that it contained a string.
As mentioned in Graylog monitor its own logs - #14 by jochen, you can use the processing pipeline to check the field content and rename the field, if it doesn’t contain a number.
