Courier Fetch

Elastic Stack Kibana
1

Sometimes I meet the following warning : Courier Fetch: 1 of 90 shards failed.
And when I look for in the elasticsearch log I find : No mapping found for ... in order to sort on
However in all shards I've the mapping : "type": "date", "format": "dateOptionalTime"

I don't understand, do you have any idea ?

2

It'd help if we could see the entire log entry.

3

for example :
[2015-08-18 17:47:55,358][DEBUG][action.search.type ] [pobmn1] [logstash-mi-2015.03.16][0], node[4CNf90b4SdyeaagQZQFcrA], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@274f39ae] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-mi-2015.03.16][0]: query[filtered(+filtered(mi_field:[* TO 10})->cache(_type:mi_type) +filtered(TIMESTAMP_DATE_EVT:{1439884075308 TO ])->cache(_type:mi_type))->BooleanFilter(+QueryWrapperFilter(ConstantScore(:)) +cache(TIMESTAMP_DATE_EVT:[1439911975432 TO 1439912875432]))],from[-1],size[500]: Parse Failure [Failed to parse source [{"query":{"filtered":{"query":{"query_string":{"query":"mi_type.mi_field:<10 AND mi_type.TIMESTAMP_DATE_EVT:>now-8h","analyze_wildcard":true}},"filter":{"bool":{"must":[{"query":{"query_string":{"query":"","analyze_wildcard":true}}},{"range":{"TIMESTAMP_DATE_EVT":{"gte":1439911975432,"lte":1439912875432}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}}},"size":500,"sort":{"mi_date":"asc"},"fields":["","_source"],"script_fields":{},"fielddata_fields":["@timestamp","mi_date","mi_date2","mi_date3","mi_date4","TIMESTAMP_DATE_EVT","mi_date5"]}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:687)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:543)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:515)
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:277)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: org.elasticsearch.search.SearchParseException: [logstash-mi-2015.03.16][0]: query[filtered(+filtered(mi_field:[* TO 10})->cache(_type:mi_type) +filtered(TIMESTAMP_DATE_EVT:{1439884075308 TO ])->cache(_type:mi_type))->BooleanFilter(+QueryWrapperFilter(ConstantScore(:*)) +cache(TIMESTAMP_DATE_EVT:[1439911975432 TO 1439912875432]))],from[-1],size[500]: Parse Failure [No mapping found for [mi_date] in order to sort on]
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:210)
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:141)
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:671)
... 9 more

4

Courier Fetch errors indicate failures on the Elasticsearch side. In this case, looks like a search query sent from the front end failed to parse on the backend.

You can see some additional discussion about conditions that trigger this error here: https://github.com/elastic/kibana/issues/3221

We are building in some additional structured exception handling in the future that should help provide more feedback at the Kibana level when such errors occur: https://github.com/elastic/kibana/issues/4536

5

Thanks
I think I found the cause : I had some visualisations with sort based on searches that used the index * so of course the sorted field did'nt exist for some index