Emergency, All shards failed for phase

Elastic Stack Elasticsearch
1

Hi, I am getting this error today. How can I handle this error?

[2018-08-06T13:22:17,640][DEBUG][o.e.a.s.TransportSearchAction] [machine] All shards failed for phase: [query]
org.elasticsearch.transport.RemoteTransportException: [IP.9300][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.query.QueryShardException: Failed to parse query [city: (SFO OR HWD OR NGZ OR NRC OR JBK OR CCR OR OAR OR HAF OR SRF OR HLI OR LVK OR JMC OR MHR OR NUQ OR MRY OR APC OR NOT OR OAK OR PAO OR RHV OR SAC OR SFO OR SJC OR SNS OR STS OR SQL OR SRU OR SCK OR VLO OR SUU OR WVI OR EMB) AND fullCity: (IST OR BDM OR TEQ OR KCO OR SAW OR YEI OR IST)]

2

What exactly did you send to elasticsearch?

3

I created reindex today. proximate 20 million document imported. And during imported throwed rejected error. I dont know how to do handle?

4

This "query"

city: (SFO OR HWD OR NGZ OR NRC OR JBK OR CCR OR OAR OR HAF OR SRF OR HLI OR LVK OR JMC OR MHR OR NUQ OR MRY OR APC OR NOT OR OAK OR PAO OR RHV OR SAC OR SFO OR SJC OR SNS OR STS OR SQL OR SRU OR SCK OR VLO OR SUU OR WVI OR EMB) AND fullCity: (IST OR BDM OR TEQ OR KCO OR SAW OR YEI OR IST)

has been sent by someone/something. What is it?
I don't thin the reindex API did that without someone to explicitly do it.

So what is the query you are sending which is generating this "error"?

5

This query is for flights data. I updated full elastic data after reindex. I added tags parameters. I have 3 clusters in ES. Elastic shard's status is green. But elasticsearch throwed above error.

There is bool query and scripts in request. For example;
** I cutted request ..

{"query":{"match":{"destinationCity":"AMM OR BRE OR ATL OR TSE OR MED OR OSL OR MLE OR BHX OR BGW OR NUE OR BJS OR SFO OR BRS OR EDI OR MSQ OR HAV OR ISE OR CAI OR CHI OR CPH OR SQD OR VCE OR BEY OR CAS OR HRK OR SJJ OR OGU OR DUS OR KYA OR NYC OR MOW OR DLM OR FRA OR DIY OR SSX OR IEV OR HTY OR AMS OR ASR OR BER OR BXN OR ECN OR TZX OR PAR OR GZT OR LON OR ADA OR AYT OR IZM OR ANK OR IST"}},"size":1000000,"script":{"inline":"if(ctx._source.destinationCity=='ANK'){ ctx._source.globalRank = 73; ctx._source.tags = params.ANK_tags; }else if(ctx._source.destinationCity=='IST'){ ctx._source.globalRank = 2; ctx._source.tags = params.IST_tags; }","params":{"ANK_tags":[{"tag":1,"evaluationCount":564},{"tag":2,"evaluationCount":2849},{"tag":3,"evaluationCount":564},{"tag":4,"evaluationCount":564},{"tag":6,"evaluationCount":46},{"tag":7,"evaluationCount":824},{"tag":8,"evaluationCount":564},{"tag":9,"evaluationCount":189},{"tag":10,"evaluationCount":199671},{"tag":11,"evaluationCount":240},{"tag":12,"evaluationCount":1377},{"tag":13,"evaluationCount":499},{"tag":14,"evaluationCount":199825},{"tag":15,"evaluationCount":2849},{"tag":16,"evaluationCount":271},{"tag":17,"evaluationCount":153},{"tag":18,"evaluationCount":499},{"tag":20,"evaluationCount":922},{"tag":21,"evaluationCount":199909},{"tag":22,"evaluationCount":2},{"tag":23,"evaluationCount":568},{"tag":26,"evaluationCount":2}],"IST_tags":[{"tag":2,"evaluationCount":199965},{"tag":5,"evaluationCount":5798},{"tag":6,"evaluationCount":24331},{"tag":7,"evaluationCount":199965},{"tag":9,"evaluationCount":199902},{"tag":10,"evaluationCount":199811},{"tag":11,"evaluationCount":199846},{"tag":12,"evaluationCount":199846},{"tag":13,"evaluationCount":199965},{"tag":14,"evaluationCount":199930},{"tag":15,"evaluationCount":199902},{"tag":16,"evaluationCount":199881},{"tag":17,"evaluationCount":199972},{"tag":18,"evaluationCount":199916},{"tag":20,"evaluationCount":199944},{"tag":21,"evaluationCount":5511},{"tag":23,"evaluationCount":199951},{"tag":27,"evaluationCount":199916},{"tag":29,"evaluationCount":199860}]}}}
6

One of the problematic thing I can read (please format your JSON content) is

"size":1000000

That's not going to work unless you changed elasticsearch index settings.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.