Mapping corruption


(octomeow-2) #1

my graylog and elasticsearch was running great, then
disk filled, elasticsearch had a fit... and it was running stand alone
so when server died no hope of recovery

when I started everything back up, I keep getting the
Your ElasticSearch mapping is invalid! Make sure it has been created
by the graylog2-server error.

I even ran the standard mapping from elasticsearch website, but no
joy. I even make sure
to delete all the data and index fields and start fresh, but somehow
it's holding on to bad mappings.


(Radu Gheorghe) #2

Would it help if you would just stop graylog, remove the graylog2
index, then create it again, and put the following mapping:

$ curl -XPUT 'http://localhost:9200/graylog2/message/_mapping' -d '
{
"message" : {
"properties" : {
"message" : {
"type" : "string"
},
"level" : {
"type" : "long"
},
"host" : {
"type" : "string"
},
"facility" : {
"type" : "string"
},
"full_message" : {
"type" : "string"
},
"line" : {
"type" : "long"
},
"created_at" : {
"type" : "double"
},
"streams" : {
"type" : "string"
}
}
}
}
'

Then when you start graylog again, it should find the correct mapping
already in place. Hopefully :slight_smile:

On Apr 16, 7:52 pm, octomeow octom...@gmail.com wrote:

my graylog and elasticsearch was running great, then
disk filled, elasticsearch had a fit... and it was running stand alone
so when server died no hope of recovery

when I started everything back up, I keep getting the
Your ElasticSearch mapping is invalid! Make sure it has been created
by the graylog2-server error.

I even ran the standard mapping from elasticsearch website, but no
joy. I even make sure
to delete all the data and index fields and start fresh, but somehow
it's holding on to bad mappings.


(system) #3