# Mapping corruption

**URL:** <https://discuss.elastic.co/t/mapping-corruption/7353>\
**Category:** Elasticsearch\
**Created:** [April 16, 2012, 4:52pm UTC](https://discuss.elastic.co/t/mapping-corruption/7353 "2012-04-16T16:52:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![octomeow\_2](https://avatars.discourse-cdn.com/v4/letter/o/ebca7d/32.png) [@octomeow\_2](https://discuss.elastic.co/u/octomeow_2)\
**Post date:** [April 16, 2012, 4:52pm UTC](https://discuss.elastic.co/t/mapping-corruption/7353/1 "2012-04-16T16:52:58Z")

</div>

my graylog and elasticsearch was running great, then  
disk filled, elasticsearch had a fit... and it was running stand alone  
so when server died no hope of recovery

when I started everything back up, I keep getting the  
Your ElasticSearch mapping is invalid! Make sure it has been created  
by the graylog2-server error.

I even ran the standard mapping from elasticsearch website, but no  
joy. I even make sure  
to delete all the data and index fields and start fresh, but somehow  
it's holding on to bad mappings.

---

<div class="post-metadata">

**Author:** ![Radu\_Gheorghe1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radu_gheorghe1/32/2688_2.png) [@Radu\_Gheorghe1](https://discuss.elastic.co/u/Radu_Gheorghe1)\
**Post date:** [April 17, 2012, 7:29am UTC](https://discuss.elastic.co/t/mapping-corruption/7353/2 "2012-04-17T07:29:01Z")

</div>

Would it help if you would just stop graylog, remove the graylog2  
index, then create it again, and put the following mapping:

$ curl -XPUT '[http://localhost:9200/graylog2/message/\_mapping](http://localhost:9200/graylog2/message/_mapping)' -d '  
{  
"message" : {  
"properties" : {  
"message" : {  
"type" : "string"  
},  
"level" : {  
"type" : "long"  
},  
"host" : {  
"type" : "string"  
},  
"facility" : {  
"type" : "string"  
},  
"full\_message" : {  
"type" : "string"  
},  
"line" : {  
"type" : "long"  
},  
"created\_at" : {  
"type" : "double"  
},  
"streams" : {  
"type" : "string"  
}  
}  
}  
}  
'

Then when you start graylog again, it should find the correct mapping  
already in place. Hopefully 🙂

On Apr 16, 7:52 pm, octomeow [octom...@gmail.com](mailto:octom...@gmail.com) wrote:

> my graylog and elasticsearch was running great, then  
> disk filled, elasticsearch had a fit... and it was running stand alone  
> so when server died no hope of recovery
> 
> when I started everything back up, I keep getting the  
> Your Elasticsearch mapping is invalid! Make sure it has been created  
> by the graylog2-server error.
> 
> I even ran the standard mapping from elasticsearch website, but no  
> joy. I even make sure  
> to delete all the data and index fields and start fresh, but somehow  
> it's holding on to bad mappings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 3:32am UTC](https://discuss.elastic.co/t/mapping-corruption/7353/3 "2017-07-06T03:32:22Z")

</div>