Expected numeric type on field [timestamp], but got [string]

Elastic Stack Elasticsearch
1

[DEBUG][action.search ] [Hit-Maker] All shards failed for phase: [query]
RemoteTransportException[[Hit-Maker][127.0.0.1:9300][indices:data/read/search[phase/query]]]; nested: IllegalArgumentException[Expected numeric type on field [timestam$
Caused by: java.lang.IllegalArgumentException: Expected numeric type on field [timestamp], but got [string]

I'm getting this error in the elastic search , Please help me to solve this issue .

2

Hey @Radhakrishnan, this looks like an easy fix. My guess is your using dynamic settings and letting Elasticsearch pick the format for the field in question. Regardless, the mapping you want for this field is 'Date' and not numeric. The date format has very specific requirements in order to ETL successfully, and if something goes wrong it will try to load the field as a string instead -- which is the problem your seeing. Date fields should not be loaded as numeric. I'd recommend reading up on the date field type here:

https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html

I use the strict-date-option-time format which looks like below:

"timestamp": {
"type": "date",
"format" : "strict_date_optional_time"
}

An example of a timestamp value that would ETL correctly is: '2017-08-09T10:16:45'

1 Like
3

Hi @MPurcell , Thanks for your solution , Actually i'm very new to this Elastic search , Please instruct me to get it done ,
root@graylog:/var/log/elasticsearch# curl -XGET localhost:9200/graylog_0
{"graylog_0":{"aliases":{"graylog_deflector":{}},"mappings":{"message":{"properties":{"application_name":{"type":"string"},"facility":{"type":"string"},"gl2_remote_ip":{"type":"string"},"gl2_remote_port":{"type":"long"},"gl2_source_input":{"type":"string"},"gl2_source_node":{"type":"string"},"level":{"type":"long"},"message":{"type":"string"},"process_id":{"type":"string"},"source":{"type":"string"},"streams":{"type":"string"},"timestamp":{"type":"string"}}}},"settings":{"index":{"creation_date":"1505470879032","analysis":{"analyzer":{"analyzer_keyword":{"filter":"lowercase","tokenizer":"keyword"}}},"number_of_shards":"4","number_of_replicas":"0","uuid":"GcPUWnsLQtWsoZRUgb6iIg","version":{"created":"2040699"}}},"warmers":{}}}

Executed like this: curl -x PUT 'http://localhost:9200/graylog_0' -d \ {"graylog_0":{"aliases":{"graylog_deflector":{}},"mappings":{"message":{"properties":{"application_name":{"type":"string"},"facility":{"type":"string"},"gl2_remote_ip":{"type":"string"},"gl2_remote_port":{"type":"long"},"gl2_source_input":{"type":"string"},"gl2_source_node":{"type":"string"},"level":{"type":"long"},"message":{"type":"string"},"process_id":{"type":"string"},"source":{"type":"string"},"streams":{"type":"string"},"timestamp":{"type": "date","format" : "strict_date_optional_time"}}}},"settings":{"index":{"creation_date":"1505470879032","analysis":{"analyzer":{"analyzer_keyword":{"filter":"lowercase","tokenizer":"keyword"}}},"number_of_shards":"4","number_of_replicas":"0","uuid":"GcPUWnsLQtWsoZRUgb6iIg","version":{"created":"2040699"}}},"warmers":{}}}

Errors:
curl: (5) Could not resolve proxy: PUT
curl: (3) [globbing] unmatched close brace/bracket in column 26

While i'm getting errors while executing . thanks in advance .

4

@Radhakrishnan From what I can see here, it looks like your missing an ending bracket. The first error curl: (5) is signifies that some aspect of your HTTP PUT request was either 1) not the same format as the data in the existing fields or 2) corrupted in some other way. The curl: (3) error is more specific telling you the issue is with your brackets and/or string formatting in your curl request. Now this is the part where I tell you to do your DEV work in Kibana rather then in cmd prompt as its much easier to debug and in this case, would probably have stopped your problem from even occurring in the first place!
Since I'm not 100% sure its a missing ending bracket, I think the first thing you should try is to turn off globbing on your put request with '-g'. If that doesn't work, I'd recommend looking at this stack overflow question, because the issue you have has to do with how your escaping your newlines/characters.

1 Like
5

Thanks for your suggestion @MPurcell .

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.