6.2.2 cannot run job: datafeed [XXX] cannot retrieve field [@timestamp] because it has no mappings

Elastic Stack Elasticsearch
1

I found out that I could not start the job because of this message: cannot run job: datafeed [XXX] cannot retrieve field [@timestamp] because it has no mappings

can you explain why?

Regards,

Here is my job:

{
  "job_id": "egt_deident",
  "job_type": "anomaly_detector",
  "job_version": "6.2.2",
  "create_time": 1527599651174,
  "established_model_memory": 565812,
  "analysis_config": {
    "bucket_span": "1d",
    "detectors": [
      {
        "detector_description": "high_mean(MES_EGT_CORRECTED)",
        "function": "high_mean",
        "field_name": "MES_EGT_CORRECTED",
        "partition_field_name": "deident.keyword",
        "rules": [],
        "detector_index": 0
      }
    ],
    "influencers": [
      "deident.keyword"
    ]
  },
  "analysis_limits": {
    "model_memory_limit": "12mb"
  },
  "data_description": {
    "time_field": "@timestamp",
    "time_format": "epoch_ms"
  },
  "model_plot_config": {
    "enabled": true
  },
  "model_snapshot_retention_days": 1,
  "results_index_name": "shared",
  "data_counts": {
    "job_id": "egt_deident",
    "processed_record_count": 847744,
    "processed_field_count": 860734,
    "input_bytes": 47958545,
    "input_field_count": 860734,
    "invalid_date_count": 0,
    "missing_field_count": 834754,
    "out_of_order_timestamp_count": 0,
    "empty_bucket_count": 0,
    "sparse_bucket_count": 0,
    "bucket_count": 622,
    "earliest_record_timestamp": 1472724132000,
    "latest_record_timestamp": 1526435403000,
    "last_data_time": 1527599709289,
    "input_record_count": 847744
  },
  "model_size_stats": {
    "job_id": "egt_deident",
    "result_type": "model_size_stats",
    "model_bytes": 565812,
    "total_by_field_count": 19,
    "total_over_field_count": 0,
    "total_partition_field_count": 18,
    "bucket_allocation_failures_count": 0,
    "memory_status": "ok",
    "log_time": 1532480497000,
    "timestamp": 1532476800000
  },
  "datafeed_config": {
    "datafeed_id": "datafeed-egt_deident",
    "job_id": "egt_deident",
    "query_delay": "97804ms",
    "indices": [
      "test__revima__b787__*"
    ],
    "types": [],
    "query": {
      "match_all": {
        "boost": 1
      }
    },
    "scroll_size": 1000,
    "chunking_config": {
      "mode": "auto"
    },
    "state": "stopped"
  },
  "state": "opened",
  "node": {
    "id": "K-B_fm1aQe29-eaWxtu8dQ",
    "name": "wilco-2",
    "ephemeral_id": "T_AqiQKpRZe4f1CtJFWPvA",
    "transport_address": "10.91.152.40:9300",
    "attributes": {
      "ml.machine_memory": "33515950080",
      "ml.max_open_jobs": "20",
      "ml.enabled": "true"
    }
  },
  "open_time": "4889523s"
}

and the confirmation of the issue

GET _xpack/ml/datafeeds/datafeed-egt_deident/_preview

{
  "error": {
    "root_cause": [
      {
        "type": "status_exception",
        "reason": "datafeed [datafeed-egt_deident] cannot retrieve field [@timestamp] because it has no mappings"
      }
    ],
    "type": "status_exception",
    "reason": "datafeed [datafeed-egt_deident] cannot retrieve field [@timestamp] because it has no mappings"
  },
  "status": 400
}
2

What do you see for:

GET test__revima__b787__*/_mapping

1 Like
3

Thank's that was the problem, I had reindexed. The message was fooling me

1 Like