ElasticsearchException - events are lost

[jerrybb]

Hi, we are sending application logs in GELF format using Fluentbit to Graylog Server. There are occasional some errors logged such as:

• failed to parse field [line] of type [long]
• failed to parse field [source_timestamp] of type [date]
• Document contains at least one immense term in field=\"param\" (whose UTF8 encoding is longer than the max length 32766

We are fixing such issue by changing field types or formatting source data to fix these issues.

But these logs events are lost until fix is applied for each occurrence. We are wondering if there is any way to store such message in any way to prevent data loss? Even if the content would not be indexed.

[tellistone]

Hi Jerrybb

If you install the enterprise plugin, you should be able to access failure processing.

This writes any message that fails to process to a dedicated stream:

Index templates or pipeline rules for the purpose of forcing data type to fields will also help you prevent this issue.

For specifics/troubleshoting, you might raise this with Enterprise Support (if you have an Enterprise license) or the Graylog Community.

[jerrybb]

Thank you @tellistone, appreciated.