Our next-gen architecture is built to help you make sense of your ever-growing data Watch a 4-min demo video!
Formats: PNG, PDF, and SVG
Files size: 2.8 MB
For brand guidelines, please click here
Having too many fields in your index can lead to a mapping problem. There is a default value of 1000 fields which is put in place to avoid search and performance degradation.
Coralogix has added an option to allow you to keep an eye on these numbers and on your mapping exceptions.
Mapping exceptions happen when we see the same field with two different types. For instance, in a log received from your account we see a field as type string and in another log the same field has been received as a number or a different type.
Mapping problems that are caused by the above conditions will result in a possibility to search the logs only in free text query. Logs that will have mapping exceptions in them or logs that contain fields that were not indexed due to the maximum set in your account will lack the advanced capabilities of Coralogix logs tab such as visualization of fields or advanced queries.
To check these stats, go under your account and click on settings, then select Mapping Stats.
The number in the right hand side shows the amount of fields used out of the total fields left in the daily index. The number of fields consumed refers to the number of all different fields that exist in your retention period.
In the screenshot above you can also see the mapping exceptions. In the example we have no mapping exceptions. If it happens and you see a different number than 0, click on the link View Mapping Dashboard which will take you to a Kibana dashboard screen with details of the exceptions you have in your account.
To identify the fields that caused the mapping exceptions you can look in the bottom part of the dashboard. To see the logs that are effected by the mapping exception you can query
_exists_:"coralogix.failed_reason" in Coralogix logs tab or in the discover tab in Kibana.
To fix the mapping exception we recommend understanding the reason fields are sent with different types and correct it at source. Should this is not an option, you can approach our support that will help you solve the case with a parsing rule.
You can find further reading in our blog post – here