Why Quarkus MDC numeric fields silently break OpenSearch queries — and how to fix it

If you're running Quarkus with JSON logging and shipping to OpenSearch,

there's a non-obvious bug waiting for you: every numeric field you put

in MDC arrives in OpenSearch as a string.

This means queries like durationMs > 1000 silently return nothing.

No error. No warning. Just wrong results.

Here's why it happens and two ways to fix it.

The problem

Quarkus uses JBoss Log Manager under the hood. When you set MDC values:

MDC.put("durationMs", String.valueOf(duration));

MDC.put("fundsProcessed", String.valueOf(count));

The SLF4J MDC API only accepts String. So even if your value is

numeric, it's a string from the moment it enters MDC.

When quarkus-logging-json serializes the log event, it writes the MDC

map as-is — strings in, strings out:

{

  "timestamp": "2026-05-09T05:00:00.000+00:00",

  "message": "Pipeline complete",

  "mdc": {

    "durationMs": "4521",

    "fundsProcessed": "1842",

    "pipeline": "nav_ingestion"

  }

}

OpenSearch infers field types on first index. It sees "4521" and

maps durationMs as keyword. Now you can never do numeric aggregations

or range queries on that field — even if you fix the type later,

existing documents are already mapped wrong.

Fix 1 — Fluent Bit type conversion (collector-side)

If you're using Fluent Bit to ship logs to OpenSearch, you can fix

the types at the collector layer before indexing.

Use a type_converter filter followed by a rename to strip the

temporary suffix:

[FILTER]

    Name          modify

    Match         *

    Rename        durationMs    durationMs_str



[FILTER]

    Name          type_converter

    Match         *

    str_key       durationMs_str  int  durationMs



[FILTER]

    Name          modify

    Match         *

    Remove        durationMs_str

Or with a Lua script for bulk conversion:

function convert_numeric_mdc(tag, timestamp, record)

    local numeric_fields = {"durationMs", "fundsProcessed", "written", "skipped", "failed"}

    for _, field in ipairs(numeric_fields) do

        if record[field] ~= nil then

            record[field] = tonumber(record[field]) or record[field]

        end

    end

    return 1, timestamp, record

end

This works but it's a workaround — you're fixing at the wrong layer,

and you have to maintain the field list in two places.

Fix 2 — Flat MDC fields (coming in Quarkus core)

The cleaner fix is to write MDC fields as root-level JSON keys instead

of nested under "mdc": {}. This lets you define your OpenSearch index

mapping explicitly per field, with the correct type from the start.

This is what PR #54038 adds to quarkus-logging-json:

quarkus.log.console.json.mdc.flat-fields=true

Before (flat-fields=false, default):

{

  "message": "Pipeline complete",

  "mdc": {

    "durationMs": "4521",

    "pipeline": "nav_ingestion"

  }

}

After (flat-fields=true):

{

  "message": "Pipeline complete",

  "durationMs": "4521",

  "pipeline": "nav_ingestion"

}

With flat fields, you can define an explicit OpenSearch index template

that maps durationMs as long regardless of what arrives as a string

— and use an ingest pipeline to do the conversion at index time,

cleanly, once.

The full production setup

Here's the stack that works in production:

1. Quarkus emits JSON logs with flat-fields=true (once #54038 merges)


2. Fluent Bit collects with persistent offsets and buffer limits


3. Fluent Bit type_converter converts known numeric fields


4. OpenSearch receives correctly-typed documents

The MDC contract I use across all pipelines:

Full working config (Fluent Bit + docker-compose + OpenSearch 2.x)

is in the repo:

If you've hit this and solved it differently, I'd like to know —

leave a comment.