Hi Jason, On Friday, 20 January 2017 06:49:20 UTC+1, Jason Haar wrote: > > Surely such "strange timestamps" are corrupt and so should be > ignored/dropped? >
Unfortunately it depends on the specific use case, whether such timestamps are valid or not. In this case, every index contained messages "16 days ago up to in a year" which lead to Graylog querying all indices all the time (because the index ranges were identical). If a corrupt field can lead to a crash, then stronger typing of that field > should be a requirement? > You can have as much or as little typing for index mappings as you like: http://docs.graylog.org/en/2.1/pages/configuration/elasticsearch.html#custom-index-mappings Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/fabfb1ea-9019-414f-b58a-9ae975c2eb25%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
