Why Quarkus MDC numeric fields silently break OpenSearch queries — and how to fix it

If you're running Quarkus with JSON logging and shipping to OpenSearch,
there's a non-obvious bug waiting for you: every numeric field you put
in MDC arrives in OpenSearch as a string.

This means queries like durationMs > 1000 silently return nothing.
No error. No warning. Just wrong results.

Here's why it happens and two ways to fix it.

The problem

Quarkus uses JBoss Log Manager under the hood. When you set MDC values:

MDC.put("durationMs", String.valueOf(duration));
MDC.put("fundsProcessed", String.valueOf(count));

The SLF4J MDC API only accepts String. So even if your value is
numeric, it's a string from the moment it enters MDC.

When quarkus-logging-json serializes the log event, it writes the MDC
map as-is — strings in, strings out:

{
  "timestamp": "2026-05-09T05:00:00.000+00:00",
  "message": "Pipeline complete",
  "mdc": {
    "durationMs": "4521",
    "fundsProcessed": "1842",
    "pipeline": "nav_ingestion"
  }
}

OpenSearch infers field types on first index. It sees "4521" and
maps durationMs as keyword. Now you can never do numeric aggregations
or range queries on that field — even if you fix the type later,
existing documents are already mapped wrong.

Fix 1 — Fluent Bit type conversion (collector-side)

If you're using Fluent Bit to ship logs to OpenSearch, you can fix
the types at the collector layer before indexing.

Use a type_converter filter followed by a rename to strip the
temporary suffix:

[FILTER]
    Name          modify
    Match         *
    Rename        durationMs    durationMs_str

[FILTER]
    Name          type_converter
    Match         *
    str_key       durationMs_str  int  durationMs

[FILTER]
    Name          modify
    Match         *
    Remove        durationMs_str

Or with a Lua script for bulk conversion:

function convert_numeric_mdc(tag, timestamp, record)
    local numeric_fields = {"durationMs", "fundsProcessed", "written", "skipped", "failed"}
    for _, field in ipairs(numeric_fields) do
        if record[field] ~= nil then
            record[field] = tonumber(record[field]) or record[field]
        end
    end
    return 1, timestamp, record
end

This works but it's a workaround — you're fixing at the wrong layer,
and you have to maintain the field list in two places.

Fix 2 — Flat MDC fields (coming in Quarkus core)

The cleaner fix is to write MDC fields as root-level JSON keys instead
of nested under "mdc": {}. This lets you define your OpenSearch index
mapping explicitly per field, with the correct type from the start.

This is what PR #54038 adds to quarkus-logging-json:

quarkus.log.console.json.mdc.flat-fields=true

Before (flat-fields=false, default):

{
  "message": "Pipeline complete",
  "mdc": {
    "durationMs": "4521",
    "pipeline": "nav_ingestion"
  }
}

After (flat-fields=true):

{
  "message": "Pipeline complete",
  "durationMs": "4521",
  "pipeline": "nav_ingestion"
}

With flat fields, you can define an explicit OpenSearch index template
that maps durationMs as long regardless of what arrives as a string
— and use an ingest pipeline to do the conversion at index time,
cleanly, once.

The full production setup

Here's the stack that works in production:

1. Quarkus emits JSON logs with flat-fields=true (once #54038 merges)
2. Fluent Bit collects with persistent offsets and buffer limits
3. Fluent Bit type_converter converts known numeric fields
4. OpenSearch receives correctly-typed documents

The MDC contract I use across all pipelines:

Full working config (Fluent Bit + docker-compose + OpenSearch 2.x)
is in the repo:
github.com/Zahanturel/quarkus-structured-logging

The flat MDC PR for Quarkus core is at:
quarkusio/quarkus#54038

If you've hit this and solved it differently, I'd like to know —
leave a comment.