Cribl Search Parquet Code 117 Errors from Mixed JSON and String Fields

Symptom

Cribl Search returns a query_execution_error when querying Parquet files written by Cribl Stream from Office 365 Activity data. The error includes Code 117 and identifies the Message column:

DB::Exception: Cannot parse JSON object here ... column: Message ... CriblParquetInputFormat ... (INCORRECT_DATA)

Environment

• Cribl Stream writes Office 365 Activity events to an object-storage Destination in Parquet format.
• Cribl Search queries the resulting Parquet dataset.
• Office 365 events contain nested JSON values in fields that are also plain strings in other events.
• The Destination uses automatic or fixed Parquet schema handling.

Resolution

1. Navigate to the Office 365 Activity Pipeline that processes events before the Parquet Destination.
2. Add a Flatten Function to the Pipeline.
3. Enter the top-level field containing nested objects, such as Message, in Fields.
4. Configure the Depth and Delimiter for the expected nested structure.
5. Save the Pipeline configuration.
6. Identify every Route that sends the affected Office 365 events to the Parquet Destination.
7. Apply the same normalization Pipeline to every matching Route.
8. Exclude events already handled by a specialized Route from broader non-final Routes.
9. Save and deploy the configuration.
10. Run a live capture with Message != null && typeof Message !== 'string' to identify remaining object values.
11. Write new Parquet files after the configuration is deployed.
12. Run a Cribl Search query against a time range containing only the new files.

Cause

This can be caused by:

• The same Parquet column receiving a JSON object in some Office 365 events and a string in others.
• Automatic schema generation preserving event structure while successive files contain different field types.
• Non-final Routes sending the same event through different Pipelines, allowing an unnormalized copy into the searched dataset.

Additional Information

• Parquet Schemas: Review Parquet schema behavior and data-mismatch handling.
• Flatten: Configure flattening for nested structures.
• Routes: Review Route order, filters, and the Final toggle.
• Existing Parquet files are not rewritten by a Pipeline change. Validate the result with files written after the normalization change.