I am getting error from tailreader and file is not being auto indexed

[katzr]

I have a .csv that was dropped in an auto index folder and I am getting this error:

-0500 ERROR TailReader - Ignoring path="X" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions conf

I did not change my process (another file was dropped here this morning and it worked fine) and this file doesn't look any different- do you know why this is happening/how to fix?

Thank you!

[mayurr98]

hey
Have you configured anything that is use for extraction in props.conf?
you have to remove the extraction from your props.conf on your forwarder. Universal Forwarders cannot extract fields (they can only filter events). To extract fields with a forwarder you would need a heavy forwarder.
have a look at this answers
https://answers.splunk.com/answers/387158/bug-during-applypendingmetadata-header-processor-d.html
https://answers.splunk.com/answers/489579/error-bug-during-applypendingmetadata-header-proce.html

let me know if this helps!