# Endless stream of logstash "No mapping found for \[@timestamp\] in order to sort on" after X-Pack install

**URL:** <https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156>\
**Category:** Logstash\
**Created:** [February 2, 2018, 6:10am UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156 "2018-02-02T06:10:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dlam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dlam/32/9861_2.png) [@dlam](https://discuss.elastic.co/u/dlam)\
**Post date:** [February 2, 2018, 6:10am UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/1 "2018-02-02T06:10:30Z")

</div>

I'm getting an endless stream of these "No mapping found for [@timestamp] in order to sort on" warnings in my logstash log. Anyone know how to stop them?

here's what i was doing

- I needed more memory for my ELK instance... so I rebuilt my environment today

- I started reloading all my documents via logstash

- Since that was going to take a long time, I tried installing X-Pack to try out its kibana CSV export

- After restarting elasticsearch / logstash... I started getting an endless stream of these messages  
in my logstash & elasticsearch logs

- They appear to be related to X-Pack's watcher or something?

- Removing x-pack dosent appear to make the endless stream of error logging =(

Any ideas would help!

- /var/log/logstash/logstash-plain.log

- elasticsearch log

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 2, 2018, 7:21am UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/2 "2018-02-02T07:21:40Z")

</div>

What does your elasticsearch filter configuration look like? It sounds like you haven't overridden the filter's `sort` option even though your index doesn't have a `@timestamp` field.

---

<div class="post-metadata">

**Author:** ![dlam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dlam/32/9861_2.png) [@dlam](https://discuss.elastic.co/u/dlam)\
**Post date:** [February 2, 2018, 7:57am UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/3 "2018-02-02T07:57:15Z")

</div>

hmm here's my logstash conf files (I think thats what you mean by "elasticsearch filter configuration"?), but from the error messages it seems related to x-pack monitoring/watching or something:

```
input {
    elasticsearch {
        user => elastic
        password => somepassword
    }
    
    file {
        path => "/log_data_folder/*.csv"
        sincedb_path => "/sincedb_logstash_paths/cool_stuff"
        # sincedb_path => "/dev/null"
        start_position => "beginning"
        type => "foobarbaz"
    }
}

filter {
    elasticsearch {
        user => elastic
        password => somepassword
    }

    if "foobarbaz" in [type] {
        csv {
            columns => ["Date","Email","Sender","Subject","Status","Tags","Subaccount","Opens","Clicks","BounceDetail","Site","Region","Age","Gender","SignupFlowID","OnboardingQuerystring","JoinDate", "MetroArea", "EmailFrequency","DayOfWeek","HourOfDay","DaysSinceJoined","UnsubTest","CoolStuffID","Offer1","Offer2","Offer3","SponsorshipID"]
            convert => {
                "Age" => "integer"
                "Clicks" => "integer"
                "Date" => "date"
                "DaysSinceJoined" => "integer"
                "HourOfDay" => "integer"
                "Offer1" => "integer"
                "Offer2" => "integer"
                "Offer3" => "integer"
                "Opens" => "integer"
            }
            remove_field => ["BounceDetail", "Sender", "Status", "Subaccount"]
            separator => ","
        }

        if ([Date] == "Date") {
            drop {}
        }

        date {
            match => ["Date", "YYYY-MM-dd HH:mm:ss"]
            target => "@timestamp"
        }

        date {
            match => ["JoinDate", "YYYY-MM-dd HH:mm:ss"]
            target => "JoinDate"
        }

        mutate {
            split => { "Tags" => ";" }
        }
    }
}

output {
      elasticsearch {
          hosts => "http://localhost:9200"
          index => "cool_stuff"
          user => elastic
          password => somepassword
      }

# stdout { codec => rubydebug }
    
}

```

another file in /etc/logstash/conf.d/

```
input {
    elasticsearch {
        user => elastic
        password => somepassword
    }

    file {
        codec => json
        path => "/log_data_folder/unsubscribe_log_folder/unsubscribe.log*"
        sincedb_path => "/sincedb_logstash_paths/unsubscribe"
        # sincedb_path => "/dev/null"
        start_position => "beginning"
        type => "unsubscribe"
    }
}

filter {
    elasticsearch {
        user => elastic
        password => somepassword
    }

    mutate {
        rename => { "asctime" => "Date" }
        # 'message' has special meaning in logstash, rename it
        rename => { "message" => "logmsg" }
        remove_field => ["levelname", "logmsg"]
    }

    date {
        match => ["Date", "YYYY-MM-dd HH:mm:ss"]
        target => "@timestamp"
    }

    date {
        match => ["Date", "YYYY-MM-dd HH:mm:ss"]
        target => "Date"
    }

    date {
        match => ["JoinDate", "YYYY-MM-dd HH:mm:ss"]
        target => "JoinDate"
    }

    json {
        source => "message"
    }
}

output {
    elasticsearch {
        hosts => "http://localhost:9200"
        index => "cool_stuff"
        user => elastic
        password => somepassword
    }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 2, 2018, 10:11am UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/4 "2018-02-02T10:11:35Z")

</div>

Since your elasticsearch filter doesn't specify the `index` option you're searching in _all_ indexes, which probably isn't what you want, but it's also an actual problem since not all indexes have a `@timestamp` to sort on (and that's the default sort field).

---

<div class="post-metadata">

**Author:** ![dlam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dlam/32/9861_2.png) [@dlam](https://discuss.elastic.co/u/dlam)\
**Post date:** [February 2, 2018, 4:32pm UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/5 "2018-02-02T16:32:33Z")

</div>

hey that worked!!!!! wooooo

that explanation totally makes sense as I added a whole bunch of elasticsearch { } filter places so I can pass username/password after turning on the xpack authentication stuff

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 4:32pm UTC](https://discuss.elastic.co/t/endless-stream-of-logstash-no-mapping-found-for-timestamp-in-order-to-sort-on-after-x-pack-install/118156/6 "2018-03-02T16:32:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.