Skip to content
This repository has been archived by the owner on Jun 29, 2023. It is now read-only.

graylog indexing failures, incorrect MessageParamX type #264

Closed
Shohou opened this issue Feb 23, 2021 · 1 comment
Closed

graylog indexing failures, incorrect MessageParamX type #264

Shohou opened this issue Feb 23, 2021 · 1 comment

Comments

@Shohou
Copy link

Shohou commented Feb 23, 2021

I'm using quarkus-logging-gelf extension which internally uses logstash-gelf version 1.14.0

In graylog I'm getting indexing errors complaining about type of the parameter

ElasticsearchException[Elasticsearch exception [type=mapper_parsing_exception, reason=failed to parse field [MessageParam3] of type [long] in document with id '1448dac1-75c8-11eb-8964-00505681de37'. Preview of field's value: '1.10.5.Final']]; nested: ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=For input string: "1.10.5.Final"]];

I believe this is because of includeLogMessageParameters property set to true, which is by default. When first message arrives with long type parameter graylog (or elasticsearch) remembers its type and all the following messages with string parameters cause indexing errors.

I believe logstash-gelf should handle this by itself by setting string parameter types for MessageParamX parameters

@mp911de
Copy link
Owner

mp911de commented Mar 1, 2021

Field types can be configured via additionalFieldTypes. Since the actual field type for each MessageParam can vary across log events, it makes sense to pre-configure these to String for maximum compatibility.

This is something we deliberately don't do out of the box as these should be decisions made on the application level.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants