Application Management

Mapping Conflict Notification - Loggly

This article helps to point out the cause and resolve the Mapping Conflict notification from the Events in their Loggly account.

First published date

9/21/2020 3:29 PM

Last published date

12/15/2022 4:54 PM

Overview

You may normally get "MappingConflict: Field originally sent as an object and later as a concrete value or an array. Remove all JSON fields" under the "notification" field in your Events in Loggly UI. This causes some or all of the fields on the events to be not indexed nor parsed properly.

Product section

Loggly

Cause

For better understanding of Mapping Conflict (a field used to be sent as one type and later a different type), please go through the example below:

1. If you first sent the field "message" as string-
  
{"message":"hello world"}

2. Then something like below:
  
{"message":{"0":"config: unknown configuration option: foo"},"timestamp":"2015-05-22T13:22:34.538Z","sessionId":"b69e156b-66b8-446e-ada4-a0bc7013657c"}

Going from a string to a nested object will cause the Mapping Conflict.
 

Resolution

Currently, we do not have an easy way to automatically expose which field is causing a conflict, you can use our search tools to pinpoint the time conflicts started happening and do some manual comparison to pinpoint the change that may be the root cause.

Below are some tips that should help:

  1. Start off by doing a search for "LogglyNotifications.type:MappingConflict" (ignore the outer quotes) across your retention period. This will show you all the events that have the mapping conflict notification.
  2. Next, change the sorting to "Ascending" and you will find the first mapping conflict. Now the key question is how is this event different from what you sent previously.
  3. Click the "View Surrounding Events" button to take a look at 5 minutes before and 5 minutes after this event. In case you have very little events, manually tweak the From time in the search to look a bit further back.
  4. Now, it's a matter of doing the manual analysis. Manually compare your JSON messages and see what changed (usually it's a field being an integer and changing to JSON or vice versa or some other change of value type). Depending on how much data you have it may be comparing with the event right before the first mapping conflict or something earlier.
When our index rolls over within 24 hours (48 hours at max), things get back to normal as long as you have stopped sending in the initial fields that caused the conflict.