Error: failure in bulk execution_graylog_ElasticSearch

Error: failure in bulk execution_graylog_ElasticSearch

Elasticsearch

Error: 

index [graylog2-aaa_111], type [message], id [cfe22850-ffca-11e5-bc48-005056020442], message [MapperParsingException[failed to parse [extractor1]]; nested: NumberFormatException

Situation:

Sometime you’ll see a sudden increase in system load and high message in your graylog server. Matter it can happen on any systems that is using ElasticSearch. In my case it was graylog.  When I get into the system and checked Graylog Server Log in “server.log” file I found these errors. I got the point that my regular expression in my Extractor1 has gone into Nested loop. So it was quite evident that due to this my queue is high and CPU load has gone up. 

Errors:

[428]: index [graylog2-aaa_111], type [message], id [cfe22850-ffca-11e5-bc48-005056020442], message [MapperParsingException[failed to parse [extractor1]]; nested: NumberFormatException[For input string: "kn []"]; ]

2016-04-11T11:50:25.025+02:00 ERROR [Messages] Failed to index [3] messages. Please check the index error log in your web interface for the reason. Error: failure in bulk execution:

[159]: index [graylog2-aaa_111], type [message], id [d007157f-ffca-11e5-bc48-005056020442], message [MapperParsingException[failed to parse [extractor1]]; nested: NumberFormatException[For input string: "lv []"]; ]

[244]: index [graylog2-aaa_111], type [message], id [d01aeb90-ffca-11e5-bc48-005056020442], message [MapperParsingException[failed to parse [extractor1]]; nested: NumberFormatException[multiple points]; ]

failed to parse [extractor1]]; nested: NumberFormatException[For input string: "d out"]; ]

2016-04-11T11:49:57.917+02:00 ERROR [Messages] Failed to index [16] messages. Please check the index error log in your web interface for the reason. Error: failure in bulk execution:

Solution: 

• I logged into graylog Web server.
• Click on System à Inputs.
• Click on Manage extractors.
• Click on extractor1.
• Then click on “EDIT” button against it to edit the Parameters associated with it.
• These Parameters would be different in each case , so the parameter I’m using would not be same as the parameters you are using for your extractors.