Parsing failure

[lkenetadmin]

Hi currently we have a issue about parsing here below is the json that is returned to us.

{
"type": "mapper_parsing_exception",
"reason": "failed to parse [remote_addr]",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Invalid format: "10.128.3.15" is malformed at ".128.3.15""
}
}

How can we address the problem since we are just new with elasticsearch.

Thanks

[warkolm (Mark Walkom)]

@lkenetadmin

"reason": "Invalid format: "10.128.3.15" is malformed at ".128.3.15""

Looks like the IP data you are sending is missing the first octet.

How are you sending the data to Elasticsearch?

[lkenetadmin]

We are sending it first to our graylog server then to elasticsearch

[warkolm (Mark Walkom)]

You may need to get some help from the graylog team as it appears that is where the problem lays.

[lkenetadmin]

Alright. Thank you for the response

[Krunal_kalaria]

hi @lkenetadmin,

this is your json or you convert the logs into json either you can try tshark for convert in perfect json mean your data should be in one line and then you can easily parse those data.