Courier Fetch error, maybe due to lack of @timestamp?

Elastic Stack Elasticsearch
5

I'm only searching the logstash-* indexes. So, all docs are generated by
Logstash.

Unless Kibana 4 is searching my few non-logstash indexes even when I told
it not too... Is that possible? How could I check?

How does Logstash generate @timestamp? Does it have anything to do with the
template I changed?

--David Reagan

On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

@timestamp is generated automatically by logstash, any documents not added
by logstash will not have it

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Wed, Mar 18, 2015 at 12:51 AM, David Reagan jerrac@gmail.com wrote:

@timestamp has always been applied automatically. Only time I've ever
touched it is when I've adjusted the date to what the log message holds,
rather than when the log message is processed by logstash.

So, I have no idea where it comes from, or how I could have turned it off
on something.

Is that in the template?

--David Reagan

On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko itamar@code972.com
wrote:

Like the error suggests, "No mapping found for [@timestamp] in order to
sort on"

Kibana expects a @timestamp field - make sure to push that in your source

--

Itamar Syn-Hershko
http://code972.com | @synhershko https://twitter.com/synhershko
Freelance Developer & Consultant
Lucene.NET committer and PMC member

On Tue, Mar 17, 2015 at 11:19 PM, David Reagan jerrac@gmail.com wrote:

I keep getting an error like this: "Courier Fetch: 5 of 270 shards
failed." in Kibana 4.0.1.

After some Googling, I think it has something to do with @timestamp not
existing for some of my data. But I'm not sure, because
https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion
was solved by not searching the kibana indexes. I'm only searching my
logstash indexes. And I'm still getting that error.

In kibana 4 I went to Settings->Indices and made sure I only have
logstash-* listed under Index Patterns.

I did recently update the template to what was in the logstash git HEAD.

See http://pastebin.com/w7PmHxXS for my
/var/log/elasticsearch/index.log output. As well as the template I'm using.
It's at the bottom of the paste.

I did check with curl -XGET '
http://localhost:9200/_cat/shards?pretty=true' to see if any shards
had issues. They all had "STARTED" as their status.

Any suggestions?

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AcBx87ctUERpoNKuDE80VQMupp10GZXB83W9Vuee5AJFQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.