Skip to content

Instantly share code, notes, and snippets.

@rayterrill

rayterrill/How to Track Down Graylog Indexer Failures.md

Created November 15, 2018 15:00
Show Gist options
  • Save rayterrill/8d5a04341a6c063ae8242c5a6c121074 to your computer and use it in GitHub Desktop.
Save rayterrill/8d5a04341a6c063ae8242c5a6c121074 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
How to Track Down Graylog Indexer Failures.md

How to Track Down Graylog Indexer Failures

"failed to parse" Messages

  1. Identify the fields that are failing to parse (for example, 'deviceCustomDate1' in the below message):
{"type":"mapper_parsing_exception","reason":"failed to parse [deviceCustomDate1]","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: \"50840-10-23\" is malformed at \"0-10-23\""}}
  1. Identify the messages that have the fields that are failing to parse. You can use Graylog's search functionality to find messages with the field names that are failing to parse:
_exists_:deviceCustomDate1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment