Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Elastic indexes Document with field value larger than max long into a field mapped as long #28428

Closed
soulis-siluos opened this issue Jan 29, 2018 · 1 comment

Comments

@soulis-siluos
Copy link

Ingest Pipeline (all versions are 5.5.0)

Metricbeat(CentOS 6.5) > Logstash(Ubuntu 16.04) > Elasticsearch(Ubuntu 16.04)

JVM Version
$ java -version
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)

Description of the problem including expected versus actual behavior
Using this pipeline i see elasticsearch successfully ingest an event occasionally that contains field data which is mapped to a long, that exceeds the value of long. I would expect elasticsearch to reject such documents as the data for the datatype is invalid. The mappings appear in elasticsearch as expected. When elasticdump is run it exports the erroneous value however when importing using elasticdump it correctly rejects the document due to invalid value.

Steps to reproduce
install metricbeat on centos and configure to send to logstash(default mappings can be used for metricbeat)
logstash configured to send to elasticsearch index log-systeminfo-{date}

Mappings and A sample document that illustrates the issue can be found attached.
The field system.process.cgroup.memory.mem.limit.bytes clearly defined as a long but has the value 9223372036854776000 which exceeds max long value of 9223372036854775807by 193

mapping.txt
sample.txt

@jimczi
Copy link
Contributor

jimczi commented Jan 30, 2018

Thanks for reporting @soulis-siluos , this is fixed in 6.1 where we reject documents that contain out of range numbers:
#26137

@jimczi jimczi closed this as completed Jan 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants