# Failed to parse \[system.filesystem.files\]: Numeric value (18446744073709551615) out of range of long **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [November 22, 2016, 1:23pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860 "2016-11-22T13:23:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![max0x7ba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max0x7ba/32/13344_2.png) [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Post date:** [November 22, 2016, 1:23pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/1 "2016-11-22T13:23:26Z")
**Elasticsearch version** : elasticsearch-5.0.0 metricbeat-5.0.1 **Plugins installed** : None **JVM version** : java version "1.8.0\_45" Java(TM) SE Runtime Environment (build 1.8.0\_45-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode) **OS version** : Red Hat Enterprise Linux Server release 6.8 (Santiago) x86\_64 **Description of the problem including expected versus actual behavior** : Metricbeat sends `system.filesystem.files` field with value of 18446744073709551615, which is (2^64 - 1). **Steps to reproduce** : 1. Enable metricset `filesystem` in `metricbeat.modules` -\> `module: system`, 2. Start `metricbeat`. 3. Observe the warning in the log. **Provide logs (if relevant)**: `2016-11-22T05:35:17-05:00 WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse [system.filesystem.files]","caused_by":{"type":"json_parse_exception","reason":"Numeric value (18446744073709551615) out of range of long (-9223372036854775808 - 9223372036854775807)\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@39fece1e; line: 1, column: 234]"}}` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 22, 2016, 3:24pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/2 "2016-11-22T15:24:58Z")
What's the filesystem type for that mount point? It looks like the filesystem is reporting `-1` for the total number of nodes. The field is defined as being unsigned so a -1 is interpreted incorrectly by things that read that value. (I have seen this before with [cephfs](https://github.com/ceph/ceph/blob/64cb5f6a2079e5a3a8c1aaddd560418abc79b831/src/client/Client.cc#L8250-L8251).) What does `stat -f ` show for that filesystem? ---
**Author:** ![max0x7ba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max0x7ba/32/13344_2.png) [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Post date:** [November 22, 2016, 4:04pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/3 "2016-11-22T16:04:20Z")
This is `/dev/hugepages` what is causing troubles: ``` $ df -h [...] nodev 16G 688M 16G 5% /dev/hugepages [...] $ stat -f /dev/hugepages File: "/dev/hugepages" ID: 0 Namelen: 255 Type: hugetlbfs Block size: 2097152 Fundamental block size: 2097152 Blocks: Total: 8192 Free: 7848 Available: 7848 Inodes: Total: 18446744073709551615 Free: -1 ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 22, 2016, 4:25pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/4 "2016-11-22T16:25:37Z")
One way you can workaround this issue is to filter out events coming from that mount point. There's a good example in the documentation, see [https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#\_filtering](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering). Most of the mount points in that example are not useful to report on so this is a good option IMO. You could also setup a filter with a condition like when system.filesystem.files == 18446744073709551615, drop\_event. Or your could just drop the `system.filesystem.files` field. [Processor Docs](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-processors.html) ---
**Author:** ![max0x7ba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max0x7ba/32/13344_2.png) [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Post date:** [November 22, 2016, 4:28pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/5 "2016-11-22T16:28:21Z")
I see, thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 20, 2016, 4:28pm UTC](https://discuss.elastic.co/t/failed-to-parse-system-filesystem-files-numeric-value-18446744073709551615-out-of-range-of-long/66860/6 "2016-12-20T16:28:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.