Courier Fetch error, maybe due to lack of @timestamp?

I keep getting an error like this: "Courier Fetch: 5 of 270 shards failed."
in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion was
solved by not searching the kibana indexes. I'm only searching my logstash
indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my /var/log/elasticsearch/index.log
output. As well as the template I'm using. It's at the bottom of the paste.

I did check with curl -XGET 'http://localhost:9200/_cat/shards?pretty=true'
to see if any shards had issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Like the error suggests, "No mapping found for [@timestamp] in order to
sort on"

Kibana expects a @timestamp field - make sure to push that in your source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jerrac@gmail.com wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my /var/log/elasticsearch/index.log
output. As well as the template I'm using. It's at the bottom of the paste.

I did check with curl -XGET 'http://localhost:9200/_cat/shards?pretty=true'
to see if any shards had issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it off
on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

Like the error suggests, "No mapping found for [@timestamp] in order to
sort on"

Kibana expects a @timestamp field - make sure to push that in your source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jerrac@gmail.com wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my /var/log/elasticsearch/index.log
output. As well as the template I'm using. It's at the bottom of the paste.

I did check with curl -XGET '
http://localhost:9200/_cat/shards?pretty=true' to see if any shards had
issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

@timestamp is generated automatically by logstash, any documents not added
by logstash will not have it

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Wed, Mar 18, 2015 at 12:51 AM, David Reagan jerrac@gmail.com wrote:

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it off
on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

Like the error suggests, "No mapping found for [@timestamp] in order to
sort on"

Kibana expects a @timestamp field - make sure to push that in your source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jerrac@gmail.com wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my
/var/log/elasticsearch/index.log output. As well as the template I'm using.
It's at the bottom of the paste.

I did check with curl -XGET '
http://localhost:9200/_cat/shards?pretty=true' to see if any shards had
issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

I'm only searching the logstash-* indexes. So, all docs are generated by
Logstash.

Unless Kibana 4 is searching my few non-logstash indexes even when I told
it not too... Is that possible? How could I check?

How does Logstash generate @timestamp? Does it have anything to do with the
template I changed?

--David Reagan

On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

@timestamp is generated automatically by logstash, any documents not added
by logstash will not have it

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Wed, Mar 18, 2015 at 12:51 AM, David Reagan jerrac@gmail.com wrote:

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it off
on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

Like the error suggests, "No mapping found for [@timestamp] in order to
sort on"

Kibana expects a @timestamp field - make sure to push that in your source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jerrac@gmail.com wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my
/var/log/elasticsearch/index.log output. As well as the template I'm using.
It's at the bottom of the paste.

I did check with curl -XGET '
http://localhost:9200/_cat/shards?pretty=true' to see if any shards
had issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AcBx87ctUERpoNKuDE80VQMupp10GZXB83W9Vuee5AJFQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Hi David,

This is probably due to Kibana trying to load an empty index and therefor
missing 5 shards (ES creates 5 shards for an index by default). I stumbled
upon the same issue as Logstash created empty indices in Elasticsearch
under certain circumstances.

Using the Marvel plugin https://www.elastic.co/downloads/marvel (free
trial during developing) you can easily sort on empty indices. After
deleting the empty index (use curl or Sense
https://chrome.google.com/webstore/detail/sense-beta/lhjgkmllcaadmopgmanpapmpjgmfcfig)
the error will be probably be gone in Kibana.

Cheers,

Rodger

Op woensdag 18 maart 2015 19:38:47 UTC+1 schreef David Reagan:

I'm only searching the logstash-* indexes. So, all docs are generated by
Logstash.

Unless Kibana 4 is searching my few non-logstash indexes even when I told
it not too... Is that possible? How could I check?

How does Logstash generate @timestamp? Does it have anything to do with
the template I changed?

--David Reagan

On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko <ita...@code972.com
<javascript:>> wrote:

@timestamp is generated automatically by logstash, any documents not
added by logstash will not have it

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Wed, Mar 18, 2015 at 12:51 AM, David Reagan <jer...@gmail.com
<javascript:>> wrote:

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it
off on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko <ita...@code972.com
<javascript:>> wrote:

Like the error suggests, "No mapping found for [@timestamp] in order
to sort on"

Kibana expects a @timestamp field - make sure to push that in your
source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan <jer...@gmail.com
<javascript:>> wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp
not existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git
HEAD.

See http://pastebin.com/w7PmHxXS for my
/var/log/elasticsearch/index.log output. As well as the template I'm using.
It's at the bottom of the paste.

I did check with curl -XGET '
http://localhost:9200/_cat/shards?pretty=true' to see if any shards
had issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe
.
To unsubscribe from this group and all its topics, send an email to
elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4c5d1245-1c70-43cc-a4a1-8a2df51390fb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

This is probably due to Kibana trying to load an empty index and therefor
missing 5 shards (ES creates 5 shards for an index by default). I stumbled
upon the same issue as Logstash created empty indices in Elasticsearch
under certain circumstances.

That was exactly it! I found my empty index, deleted it, and the error
message went away. Thanks!

--David Reagan

On Sat, Apr 11, 2015 at 6:05 AM, Rodger Moore rodgerblom@gmail.com wrote:

Hi David,

This is probably due to Kibana trying to load an empty index and therefor
missing 5 shards (ES creates 5 shards for an index by default). I stumbled
upon the same issue as Logstash created empty indices in Elasticsearch
under certain circumstances.

Using the Marvel plugin https://www.elastic.co/downloads/marvel (free
trial during developing) you can easily sort on empty indices. After
deleting the empty index (use curl or Sense
https://chrome.google.com/webstore/detail/sense-beta/lhjgkmllcaadmopgmanpapmpjgmfcfig)
the error will be probably be gone in Kibana.

Cheers,

Rodger

Op woensdag 18 maart 2015 19:38:47 UTC+1 schreef David Reagan:

I'm only searching the logstash-* indexes. So, all docs are generated by
Logstash.

Unless Kibana 4 is searching my few non-logstash indexes even when I told
it not too... Is that possible? How could I check?

How does Logstash generate @timestamp? Does it have anything to do with
the template I changed?

--David Reagan

On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko ita...@code972.com
wrote:

@timestamp is generated automatically by logstash, any documents not
added by logstash will not have it

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Wed, Mar 18, 2015 at 12:51 AM, David Reagan jer...@gmail.com wrote:

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it
off on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko <ita...@code972.com

wrote:

Like the error suggests, "No mapping found for [@timestamp] in order
to sort on"

Kibana expects a @timestamp field - make sure to push that in your
source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jer...@gmail.com
wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp
not existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/
L6AG3dZOGJ8/discussion was solved by not searching the kibana
indexes. I'm only searching my logstash indexes. And I'm still getting that
error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git
HEAD.

See http://pastebin.com/w7PmHxXS for my /var/log/elasticsearch/index.log
output. As well as the template I'm using. It's at the bottom of the paste.

I did check with curl -XGET 'http://localhost:9200/_cat/
shards?pretty=true' to see if any shards had issues. They all had
"STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it,
send an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%
40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/
topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX
6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%
2B-3g8w2hbWJTyRThw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/
topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearc...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%
3DwJFX3qTng%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/4c5d1245-1c70-43cc-a4a1-8a2df51390fb%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/4c5d1245-1c70-43cc-a4a1-8a2df51390fb%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AcJ879EPyfUGC7voXWQAOXuBXH2Onb5b-OyMHLxYvDNWg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.