Graylog: Reason for the issue

This documentation is part of the Data mapping issues guide. View the full guide here: How to solve Graylog index data mapping problems.

👋 Welcome to Stackhero documentation

Stackhero provides a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Rely on an unlimited, dedicated SMTP email server included with your service.
• Apply updates effortlessly with a single click, with no manual intervention needed.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), giving your team secure, direct access.
• Experience strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbors.

Focus on your data, not your tooling: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

This issue arises from OpenSearch's dynamic mapping feature. Dynamic mapping automatically determines the data type of each field based on the first document written to an index. Once set, this data type is "locked in", and any future documents with a different data type for that field are rejected, causing a mapper parsing exception.

When a new index is created, the first document defines the index mapping. For instance, if the document contains a "level" field with a value of 3 (a numeric value), OpenSearch sets the data type for "level" to "long" (a numeric type). If a later document sent to Graylog contains the "level" field set to "error" (a string type), it will be rejected because the data type does not match the initially set type. This triggers a mapper_parsing_exception error with the reason failed to parse field [level] of type [long] in document with id 'xxx'.

This issue can happen with any field if the data types are inconsistent across documents.