Elasticsearch reporting MapperParsingException

Solution Verified - Updated -

Issue

  • The Elasticsearch is reporting MapperParsingException errors as:

    [2019-03-12T05:18:49,599][DEBUG][o.e.a.b.TransportShardBulkAction] [logging-es-data-master-xxxx1234] [project.example.430645bb-xxxx-xxxx-9d5f-0050xxxxxxxx.2019.01.01][0] failed to execute bulk item (create) BulkShardRequest [[project.example.430645bb-xxxx-xxxx-9d5f-0050xxxxxxxx.2019.01.01][0]] containing [786] requests
    org.elasticsearch.index.mapper.MapperParsingException: failed to parse [arg1]
    at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:298) ~[elasticsearch-5.6.12.redhat-1.jar:5.6.12.redhat-1]
    
  • Elasticsearch gets an object mapping conflict between two data types like int, string, etc

    [2019-03-12T23:23:01,193][DEBUG][o.e.a.b.TransportShardBulkAction] [logging-es-data-master-xxxx1234] [project.example.430645bb-xxxx-xxxx-9d5f-0050xxxxxxxx.2019.01.01][0] failed to execute bulk item (create) BulkShardRequest [[project.example.430645bb-xxxx-xxxx-9d5f-0050xxxxxxxx.2019.01.01][0]] containing [23] requests
    org.elasticsearch.index.mapper.MapperParsingException: object mapping for [arg0] tried to parse field [arg0] as object, but found a concrete value
    
  • Fluentd shows errors where Elasticsearch rejects ingesting:

    2019-02-27 22:24:30 -0500 [warn]: dump an error event: error_class=Fluent::ElasticsearchErrorHandler::ElasticsearchError error="400 - Rejected by Elasticsearch" location=nil tag="output_tag" time=1551324269 record={"@timestamp"=>"2019-02-28T03:24:29.045296996Z", . . .
    
  • Vector shows errors where Elasticsearch rejects ingesting:

    2023-08-21T18:28:56.463745Z ERROR sink{component_kind="sink" component_id=elasticsearch_secure component_type=elasticsearch component_name=elasticsearch_secure}: vector::sinks::util::retries: Not retriable; dropping the request. reason="error type: mapper_parsing_exception, reason: failed to parse" internal_log_rate_limit=true
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 3
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 5
  • Fluentd
  • Vector
  • Elasticsearch

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content