Courier Fetch: 30 of 50 shards failed


I'm trying to create a scripted field where if the source IP host name is available, that will be shown, otherwise the IP itself will be displayed. Currently, if I were to set the term to just the source IP or just the source host, I do not run into any courier fetch issues. However, when I select my scripted field that contains....

if (doc['srcip_host.keyword'].value != null)
return doc['srcip_host.keyword'].value;
else return doc['srcip'].value

I'm given a yellow colored notice "Courier Fetch: 30 of 50 shards failed."

My graph is still able to be generated, but now I wonder if the notice means that not all of my data is being visualized. How do I fix this problem?


Check the logs, it should state why it's failing./

Hi Mark,

I've checked the logs for both kibana and elasticsearch and there doesn't seem to be any error. The only message generated is....

[2017-07-18T00:34:25,366][WARN ][org.elasticsearch.deprecation.common.ParseField] Deprecated field [valueType] used, expected [value_type] instead

For some reason, this warning message is also affecting one of my other visualizations on another dashboard.
Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.