9 out of 42 shards failed

Elastic Stack Elasticsearch
1

Have setup a dashboard but when loading this dashboard or the visualizations I get 9 out of 42 shards failed .. shortly as a popup in ELKSTACK 6.4.2. But the dashboard as well as the visualizations still shows fine.

I Had to change mapping type of the properties field to keyword before I could get aggragatable on these fields. So this means I have 5 indices where this type is text, and a new index where it is keyword.

Is the change my problem ? and how can I fix it ?
Is it simply to just PUT mapping to the 5 indices with the new type ?

2

If the data isn't time based, ie you won't delete the other 5 indices after some time, then you will want to reindex so that the new mapping can be applied.

If if it time based, just wait it out :slight_smile:

3

They are timebased ... But if I search for only today in Kibana, where the type is keyword it still shows the error ?

4

What do your Elasticsearch logs show?

5

The only actual exception is:

org.elasticsearch.transport.RemoteTransportException: [dataNode1][10.2.128.13:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [Properties.Client.DeviceManufacturer] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

I have 1 master node and 2 data nodes ... the ip point to one of my data nodes ....

6

So you still think my only option is to create a new temp index with settings and mappings, reindex to this new index .... delete the old index, create the index again with the date, and then reindex som temp index to this new index with correct date-name ?

7

If you cannot wait until you age the old data out, then a reindex is the only real option.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.