error [10:34:54.287] [null_pointer_exception] null :: {"path":"/_xpack/ml/datafeeds/datafeed-alert-mem/_stop","query":{},"statusCode":500,"response":"{"error":{"root_cause":[{"type":"null_pointer_exception","reason":null}],"type":"null_pointer_exception","reason":null},"status":500}"}
at respond (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\transport.js:295:15)
at checkRespForFailure (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\transport.js:254:7)
at HttpConnector. (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\connectors\http.js:157:7)
at IncomingMessage.bound (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\node_modules\lodash\dist\lodash.js:729:21)
at emitNone (events.js:91:20)
at IncomingMessage.emit (events.js:185:7)
at endReadableNT (_stream_readable.js:974:12)
at _combinedTickCallback (internal/process/next_tick.js:80:11)
at process._tickDomainCallback (internal/process/next_tick.js:128:9)
thank for the quick reply @dkyle.
I used elasticsearch, kibana and x-pack version 5.4.1 .
And example elasticsearch.log.
[2017-07-14T17:34:53,375][WARN ][r.suppressed ] path: /_xpack/ml/datafeeds/datafeed-alert-mem/_stop, params: {datafeed_id=datafeed-alert-mem}
java.lang.NullPointerException: null
at org.elasticsearch.cluster.node.DiscoveryNodes.isAllNodes(DiscoveryNodes.java:232) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.cluster.node.DiscoveryNodes.resolveNodes(DiscoveryNodes.java:290) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction.resolveNodes(TransportTasksAction.java:167) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction$AsyncAction.(TransportTasksAction.java:246) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction$AsyncAction.(TransportTasksAction.java:231) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction.doExecute(TransportTasksAction.java:104) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.ml.action.StopDatafeedAction$TransportAction.doExecute(StopDatafeedAction.java:351) ~[?:?]
at org.elasticsearch.xpack.ml.action.StopDatafeedAction$TransportAction.doExecute(StopDatafeedAction.java:265) ~[?:?]
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:170) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$apply$1(SecurityActionFilter.java:128) ~[?:?]
at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:59) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$authorizeRequest$4(SecurityActionFilter.java:203) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.maybeRun(AuthorizationUtils.java:127) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.setRunAsRoles(AuthorizationUtils.java:121) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.authorize(AuthorizationUtils.java:109) ~[?:?]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.authorizeRequest(SecurityActionFilter.java:205) ~[?:?]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$applyInternal$3(SecurityActionFilter.java:181) ~[?:?]
Machine Learning in X-Pack GA'd in the 5.5 release. Version 5.4.1 is a beta release. I really recommend upgrading to 5.5 where you will benefit from a number of improvements.
Are you running on a multi-node cluster? From the snippet of the log file it appears the datafeed has already stopped - possibly because the node it was running on left the cluster.
I think the issue is that the datafeed is reported as being in the started state but it is actually stopped. You can check this via the Task API. If the datafeed is running you will see a task named datafeed-alert-mem.
The root cause of the issue is fixed in 5.5 so again I would encourage you to upgrade. Version 5.5 also has a force delete option which would help in this situation.
If you can't upgrade you can continue to create new jobs and datafeeds, the existing alert-mem datafeed won't affect any new jobs. I'm sorry you are having these problems I recommend creating a new multi-metric job and exploring the ML features in a new job.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.