Discover: Null keys are not supported


(Jeff Haynie) #1

I have a time based index for Elastic which is putting time records into the DB.

When i setup a time based mapping in Kibana, I get an exception displayed at the top of Kibana "Discover: Null keys are not supported". Here's the console output from ES:

[2016-06-26 19:03:13,429][DEBUG][action.search            ] [Captain Atlas] All shards failed for phase: [query]
RemoteTransportException[[Captain Atlas][172.17.0.3:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"size":500,"sort":[{}],"query":{"filtered":{"query":{"query_string":{"analyze_wildcard":true,"query":"*"}},"filter":{"bool":{"must":[{"range":{}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647},"aggs":{"2":{"date_histogram":{"field":"$timestamp","interval":"30s","time_zone":"America/Los_Angeles","min_doc_count":0,"extended_bounds":{"min":1466966893402,"max":1466967793402}}}},"fields":["*","_source"],"script_fields":{},"fielddata_fields":["container.state.StartedAt","container.state.FinishedAt","$timestamp"]}]]; nested: IllegalArgumentException[Null keys are not supported];
Caused by: SearchParseException[failed to parse search source [{"size":500,"sort":[{}],"query":{"filtered":{"query":{"query_string":{"analyze_wildcard":true,"query":"*"}},"filter":{"bool":{"must":[{"range":{}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647},"aggs":{"2":{"date_histogram":{"field":"$timestamp","interval":"30s","time_zone":"America/Los_Angeles","min_doc_count":0,"extended_bounds":{"min":1466966893402,"max":1466967793402}}}},"fields":["*","_source"],"script_fields":{},"fielddata_fields":["container.state.StartedAt","container.state.FinishedAt","$timestamp"]}]]; nested: IllegalArgumentException[Null keys are not supported];
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:855)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:654)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:620)
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:371)
at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)
at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)
at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33)
at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)
at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:376)
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.IllegalArgumentException: Null keys are not supported
at com.google.common.base.Preconditions.checkArgument(Preconditions.java:122)
at org.elasticsearch.common.collect.CopyOnWriteHashMap.get(CopyOnWriteHashMap.java:477)
at org.elasticsearch.index.mapper.FieldTypeLookup.get(FieldTypeLookup.java:172)
at org.elasticsearch.index.mapper.MapperService.fullName(MapperService.java:664)
at org.elasticsearch.index.mapper.MapperService.smartNameFieldType(MapperService.java:690)
at org.elasticsearch.index.mapper.MapperService.smartNameFieldType(MapperService.java:699)
at org.elasticsearch.index.query.QueryParseContext.fieldMapper(QueryParseContext.java:288)
at org.elasticsearch.index.query.RangeQueryParser.parse(RangeQueryParser.java:126)
at org.elasticsearch.index.query.QueryParseContext.parseInnerQuery(QueryParseContext.java:250)
at org.elasticsearch.index.query.BoolQueryParser.parse(BoolQueryParser.java:110)
at org.elasticsearch.index.query.QueryParseContext.parseInnerQuery(QueryParseContext.java:250)
at org.elasticsearch.index.query.QueryParseContext.parseInnerFilter(QueryParseContext.java:263)
at org.elasticsearch.index.query.FilteredQueryParser.parse(FilteredQueryParser.java:79)

... 12 more

I've searched online and can't find any details. The object going in (this fails with just one PUT of one record) does not have any null keys or null values.


(Jeff Haynie) #2

Here is the PUT template for the log:

  -> PUT http://192.168.86.204:9200/_template/logagent?create=true
  {
    "template": "logagent-*",
    "mappings": {
      "health": {
        "properties": {
          "$timestamp": {
            "type": "date",
            "format": "YYYY-MM-dd HH:mm:ss,SSS"
          },
          "status": {
            "type": "string",
            "index": "not_analyzed",
            "null_value": ""
          },
          "container": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "index": "not_analyzed",
                "null_value": ""
              },
              "state": {
                "type": "object",
                "properties": {
                  "Status": {
                    "type": "string",
                    "index": "not_analyzed",
                    "null_value": ""
                  },
                  "Running": {
                    "type": "boolean",
                    "null_value": false
                  },
                  "Paused": {
                    "type": "boolean",
                    "null_value": false
                  },
                  "Restarting": {
                    "type": "boolean",
                    "null_value": false
                  },
                  "OOMKilled": {
                    "type": "boolean",
                    "null_value": false
                  },
                  "Dead": {
                    "type": "boolean",
                    "null_value": false
                  },
                  "Pid": {
                    "type": "integer",
                    "null_value": 0
                  },
                  "ExitCode": {
                    "type": "integer",
                    "null_value": 0
                  },
                  "Error": {
                    "type": "string",
                    "null_value": ""
                  },
                  "StartedAt": {
                    "type": "date",
                    "format": "YYYY-MM-dd HH:mm:ss,SSS"
                  },
                  "FinishedAt": {
                    "type": "date",
                    "format": "YYYY-MM-dd HH:mm:ss,SSS"
                  }
                }
              },
              "imageid": {
                "type": "string",
                "index": "not_analyzed",
                "null_value": ""
              },
              "image": {
                "type": "string",
                "index": "not_analyzed",
                "null_value": ""
              },
              "name": {
                "type": "string",
                "null_value": ""
              },
              "hostname": {
                "type": "string",
                "null_value": ""
              },
              "domainname": {
                "type": "string",
                "null_value": ""
              },
              "ipaddress": {
                "type": "string",
                "index": "not_analyzed",
                "null_value": ""
              },
              "macaddress": {
                "type": "string",
                "index": "not_analyzed",
                "null_value": ""
              },
              "labels": {
                "type": "object"
              },
              "extra": {
                "type": "object"
              }
            }
          }
        }
      },
      "log": {
        "properties": {
          "$timestamp": {
            "type": "date",
            "format": "YYYY-MM-dd HH:mm:ss,SSS"
          },
          "message": {
            "type": "string",
            "null_value": ""
          },
          "severity": {
            "type": "string",
            "index": "not_analyzed",
            "null_value": ""
          },
          "type": {
            "type": "string",
            "index": "not_analyzed",
            "null_value": ""
          },
          "containerid": {
            "type": "string",
            "index": "not_analyzed",
            "null_value": ""
          }
        }
      }
    }
  }
  <- 200
  {
    "acknowledged": true
  }

(Tyler Smalley) #3

It doesn't sound like there is an issue with the template, but rather the data which have been indexed.


(system) #4