Courier Fetch: x of y shards failed, field type double mapping

Elastic Stack Elasticsearch
1

I am getting Courier Fetch shard failed errors when trying to build a visualization. I have narrowed it down to one field I am trying to map as number to obtain an average. I even try clearing data mapping, and I still get the error. The process I follow is:

  1. stop logstash clients
  2. delete mapping:
    Invoke-RestMethod http://localhost:9200/logstash-*/_mapping/IISLog -Method Delete
  3. reset mapping
    Invoke-RestMethod http://localhost:9200/logstash-*/_mapping/IISLog -Method Put -Body '{"properties":{"timetaken":{"type":"double"},"uristem":{"type":"string","index":"not_analyzed"}}}'
  4. delete index
  5. recreate index

I still get the error when trying to build the visualization. What I have noticed though, if I clear today's logstash data, the courier fetch error stops, but then of course I have no data to visualize. I can validate that the timetaken field is of type number.

Thanks,
Jason

2

What's the error that is being reported in ES look like?

3

The error says what I listed in the title of this discussion, courer fetch: 5 of 250 shards failed.

4

I mean the complete error in the Elasticsearch log.

5

i get this

aand in the logs Elasticsearch this:

Error Mapping