I have a elasticsearch cluster running the 1.7.5 version. I've updated the cluster to Elasticsearch 2.3.2. The system works: Events are inserted, can query elastic search, but I see this error in the logs:
[2016-06-15 14:43:04,330][WARN ][index.warmer ] [ip-10-0-0-222-avos] [logs-2016-06-15-23][0] failed to warm-up global ordinals for [message.has_alarm] java.lang.ClassCastException: org.elasticsearch.index.fielddata.plain.PackedArrayIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexFieldData$Global at org.elasticsearch.search.SearchService$FieldDataWarmer$3.run(SearchService.java:1104) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745)
This is a warning message that I can ignore or is better to investigate the issue. The problem is that this is an old index with eager_global_ordinals enabled in a boolean field. This can be done in the 1.7.5 but no in 2.3.2.