I'm trying to create a scripted field where if the source IP host name is available, that will be shown, otherwise the IP itself will be displayed. Currently, if I were to set the term to just the source IP or just the source host, I do not run into any courier fetch issues. However, when I select my scripted field that contains....
if (doc['srcip_host.keyword'].value != null)
else return doc['srcip'].value
I'm given a yellow colored notice "Courier Fetch: 30 of 50 shards failed."
My graph is still able to be generated, but now I wonder if the notice means that not all of my data is being visualized. How do I fix this problem?