Schema Discovery failure triggered

[pboguszewski]

I updated to Log Insight 2.5 yesterday.  I am now getting this error upon any restart of the service:

----------------------------------

This alert is about your Log Insight installation on loginsight.blah.com

Log Insight - Schema Discovery failure triggered at 2014-12-11T19:25:52.265Z

Schema Discovery has detected 75000 event types. This large number of event types indicates that Schema Discovery is unable to process your logs correctly, and could impact ingestion and query performance.

To ensure that Log Insight performance is not degraded, Schema Discovery has been disabled.

This message was generated by your Log Insight installation, visit the Documentation Center for more information.

----------------------------------

Please let me know if this is something I can easily fix.

Thanks!

[sflanders]

Nothing to fix - some machine learning changes were made in LI 2.5 including reducing the maximum allowed schema discovers to 75,000. It appears you have over 75,000 and as such schema discovered turned off. When the number reduces, schema discovery will automatically turn back on. If you are interested in providing some data on your instance so we can determine why you have so many discovered patterns please open a SR - let me know the SR number when you do.

[pboguszewski]

SR# 14571770012 - I will keep you posted.

[sflanders]

Thanks - escalated

[Brenners]

Hi,

I have a customer hitting the same issue after upgrading from 2.0.5 --> 2.5.

Is there any way to check when discovery is back on line?

Thanks in Advance!

[sflanders]

Yes - on the IA select Event Types. If you get results for recent time ranges (e.g. last 24 hours) then it is on.

[Brenners]

Thanks! Your input is greatly appreciated!