Graylog: How to resolve the issue

This documentation is part of the Data mapping issues guide. You can view the complete guide here: How to resolve Graylog index data mapping problems.

👋 Welcome to Stackhero documentation

Stackhero offers a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Rely on an unlimited, dedicated SMTP email server included with your service.
• Apply updates effortlessly with a single click, with no manual intervention required.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), providing your team with secure, direct access.
• Benefit from strong performance and security on a private, dedicated infrastructure, with no shared resources or noisy neighbours.

Focus on your data, not your tools: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

To resolve this issue, you have two options:

1. Ensure consistent data types across systems

The ideal solution is to standardise the data types used for fields across all systems sending data to Graylog. For example, ensure that the "level" field is always sent either as a string (such as "error", "warn", etc.) or always as a number (3, 4, etc.). This consistency prevents mapping conflicts and ensures all documents are ingested correctly.

2. Use Graylog pipelines for data conversion

If standardising data types across all systems is not possible, you can use Graylog's pipelines to convert data types upon receipt. Pipelines allow you to define rules that transform data according to specific conditions.

To implement this solution:

• Go to "System" > "Pipelines" in the Graylog web interface.
• Click "Add new pipeline" to create a new pipeline.
• Define rules to convert the "level" field (or other fields) to the desired data type. For example, you can convert numeric levels to their corresponding string representations (such as 3 to "error", 4 to "warning", etc.).

This approach ensures that all incoming data conforms to the expected data types, thereby preventing mapping conflicts.