Deleting index using DELETE in dev tools leads to error

hi all,

I found following error in elasticsearch log:

  [2019-04-23T11:28:20,537][DEBUG][o.e.a.s.TransportSearchAction] [node-S11] [dis_–êw][1], node[2AqXLcbmSmqyWhrWxqkdFA], [R], s[STARTED], a[id=g3i5xwTSRwuOmF5PTx9qTQ]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[dis_*], indicesOptions=IndicesOptions[ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false], types=[], routing='null', preference='1555979423655', requestCache=null, scroll=null, maxConcurrentShardRequests=15, batchedReduceSize=512, preFilterShardSize=14, allowPartialSearchResults=true, source={"size":0,"timeout":"30000ms","query":{"bool":{"must":[{"match_all":{"boost":1.0}},{"match_all":{"boost":1.0}},{"range":{"Date_Time":{"from":1556002100547,"to":1556002700547,"include_lower":true,"include_upper":true,"format":"epoch_millis","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":[{"field":"@timestamp","format":"date_time"},{"field":"Date","format":"date_time"},{"field":"Date_Time","format":"date_time"},{"field":"PDate","format":"date_time"},{"field":"PDate_Time","format":"date_time"}],"script_fields":{},"aggregations":{"2":{"date_histogram":{"field":"Date_Time","interval":"10s","offset":0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":1},"aggregations":{"3":{"terms":{"field":"host.name.keyword","size":5,"min_doc_count":1,"shard_min_doc_count":0,"show_term_doc_count_error":false,"order":[{"1":"desc"},{"_key":"asc"}]},"aggregations":{"1":{"max":{"field":"PacketDuration"}}}}}}}}}] lastShard [true]
  org.elasticsearch.transport.RemoteTransportException: [node-12][0.0.0.12:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [Date_Time] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:670) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:115) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.index.query.QueryShardContext.getForField(QueryShardContext.java:166) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceConfig.resolve(ValuesSourceConfig.java:95) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:317) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:310) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:139) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:336) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:807) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService.createContext(SearchService.java:616) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:592) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:367) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService.access$100(SearchService.java:121) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:339) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:335) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.SearchService$4.doRun(SearchService.java:1082) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:723) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[?:1.8.0_152]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[?:1.8.0_152]
at java.lang.Thread.run(Unknown Source) [?:1.8.0_152]

actually, the index had been named based on the following template:

"dis_%{Date}

but the value of "Date" is wrong in some input records which leads to wrong index, now I want to delete this index using following command in dev tools of kibana:

DELETE /dis_–êw, but following error has been found, how can i delete this index?

{
  "statusCode": 500,
  "error": "Internal Server Error",
  "message": "An internal server error occurred"
}

Do you see an error in your Elasticsearch log when executing the request in dev tools? (the first error you posted doesn't look like one I'd expect to get from that request). You might also be able to see the error in the network tab of your browser's dev tools.

@Bargs many thanks for your reply, elasticsearch log had been checked and there is nothing except the mentioned message:

  [2019-04-23T11:28:20,537][DEBUG][o.e.a.s.TransportSearchAction] [node-S11] [dispatcher-card1_packets_–êw ][1], node[2AqXLcbmSmqyWhrWxqkdFA], [R], s[STARTED], a[id=g3i5xwTSRwuOmF5PTx9qTQ]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[dis*], indicesOptions=IndicesOptions[ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false], types=[], routing='null', preference='1555979423655', requestCache=null, scroll=null, maxConcurrentShardRequests=15, batchedReduceSize=512, preFilterShardSize=14, allowPartialSearchResults=true, source={"size":0,"timeout":"30000ms","query":{"bool":{"must":[{"match_all":{"boost":1.0}},{"match_all":{"boost":1.0}},{"range":{"Date_Time":{"from":1556002100547,"to":1556002700547,"include_lower":true,"include_upper":true,"format":"epoch_millis","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":[{"field":"@timestamp","format":"date_time"},{"field":"Date","format":"date_time"},{"field":"Date_Time","format":"date_time"},{"field":"PDate","format":"date_time"},{"field":"PDate_Time","format":"date_time"}],"script_fields":{},"aggregations":{"2":{"date_histogram":{"field":"Date_Time","interval":"10s","offset":0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":1},"aggregations":{"3":{"terms":{"field":"host.name.keyword","size":5,"min_doc_count":1,"shard_min_doc_count":0,"show_term_doc_count_error":false,"order":[{"1":"desc"},{"_key":"asc"}]},"aggregations":{"1":{"max":{"field":"PacketDuration"}}}}}}}}}] lastShard [true]
 org.elasticsearch.transport.RemoteTransportException: [node-12][0.0.0.12:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [Date_Time] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:670) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:115) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.index.query.QueryShardContext.getForField(QueryShardContext.java:166) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceConfig.resolve(ValuesSourceConfig.java:95) ~[elasticsearch-6.5.4.jar:6.5.4]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:317) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:310) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:139) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:336) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService.parseSource(SearchService.java:807) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService.createContext(SearchService.java:616) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:592) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:367) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService.access$100(SearchService.java:121) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:339) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:335) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.search.SearchService$4.doRun(SearchService.java:1082) ~[elasticsearch-6.5.4.jar:6.5.4]

  at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:723) ~[elasticsearch-6.5.4.jar:6.5.4]

 at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]

   at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) ~[elasticsearch-6.5.4.jar:6.5.4]

at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.5.4.jar:6.5.4]

 at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[?:1.8.0_152]

 at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[?:1.8.0_152]
at java.lang.Thread.run(Unknown Source) [?:1.8.0_152]

following has been found in network tab of chrome's dev tools:

notably, in this case the index name is "dispatcher-card1_packets_–êw"

executing the command "GET _cat/indices?v" leads to following:

in addition, when i execute following command "DELETE /dispatcher-card1_packets_–êw" and "GET /dispatcher-card1_packets_–êw/_count" in dev's tools of kibana the same error can be found:

image

@Bargs could you please advise me about this case?

If there are no additional error messages in the ES log then that makes me think the issue must be in Kibana or between Kibana and ES. Do you see any errors in the Kibana log? You may need to enable the logging.verbose setting in kibana.yml.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.