Courier Fetch: 30 of 50 shards failed

Elastic Stack Elasticsearch
1

Hi,

I'm trying to create a scripted field where if the source IP host name is available, that will be shown, otherwise the IP itself will be displayed. Currently, if I were to set the term to just the source IP or just the source host, I do not run into any courier fetch issues. However, when I select my scripted field that contains....

if (doc['srcip_host.keyword'].value != null)
return doc['srcip_host.keyword'].value;
else return doc['srcip'].value

I'm given a yellow colored notice "Courier Fetch: 30 of 50 shards failed."

My graph is still able to be generated, but now I wonder if the notice means that not all of my data is being visualized. How do I fix this problem?

Thanks!

2

Check the logs, it should state why it's failing./

3

Hi Mark,

I've checked the logs for both kibana and elasticsearch and there doesn't seem to be any error. The only message generated is....

[2017-07-18T00:34:25,366][WARN ][org.elasticsearch.deprecation.common.ParseField] Deprecated field [valueType] used, expected [value_type] instead

For some reason, this warning message is also affecting one of my other visualizations on another dashboard.
Thank you