Graylog: Reason for the issue

This documentation is part of the Data mapping issues guide. You can view the complete guide here: How to resolve Graylog index data mapping problems.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

• Unlimited and dedicated SMTP email server included.
• Effortless updates with just a click.
• Customizable domain name secured with HTTPS (for example, https://logs.your-company.com).
• Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

This issue is caused by OpenSearch's dynamic mapping feature. Dynamic mapping automatically determines the data type of each field based on the first document written to an index. Once this data type is set, it becomes "locked in", and any subsequent document containing a different data type for that field will be rejected, resulting in a mapper parsing exception.

When a new index is created, the first document defines the index mapping. For example, if the document contains a "level" field with a value of 3 (a numeric value), OpenSearch sets the data type for "level" to "long" (a numeric type). If a later document sent to Graylog contains the "level" field with the value "error" (a string), it will be rejected because the data type does not match the one initially set. This triggers a mapper_parsing_exception error with the reason failed to parse field [level] of type [long] in document with id 'xxx'.

This issue can occur with any field if data types are inconsistent across documents.