Error: [illegal_state_exception] trying to merge the field stats of field

Elastic Stack Elasticsearch
1

After setting up a new Elasticsearch 5 Alpha 2 cluster, and redirecting our logstash pipe to send logs to this new cluster, I'm getting this error in Kibana:

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016.05.22] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

This error shows up when I open the Discover tab in Kibana.

It looks like this is a known issue.. Is there a work around so my team can continue to use Kibana until the next release?

2

Best I can tell, this is an issue with the mappings in your indices not matching quite right. See https://github.com/elastic/elasticsearch/issues/18135

3

Meaning, mappings in some indices, differ from mappings in other indices? This shouldn't be the case, as there was no preexisting data before I started sending data in from logstash on the new cluster.

4

I've gotten past the error, hopefully for good... This is how:

  1. Stopped the Logstash pipeline
  2. Deleted all logstash-* indices, (2 days worth)
  3. Deleted the logstash pattern in Kibana
  4. Re-started logstash pipline
  5. Re-created logstash index pattern

Now I'm able to explore in Kibana and I don't see the error.. I'll update this thread if the issue comes back.

In hindsight, it may be wise to just delete the index mentioned in the exception.

1 Like
5

The error has come back:

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016.05.23] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

It seems like if there is only one Logstash index, Kibana works fine, but as soon as logstash creates a new index, this error comes up on the explore tab and we're unable to use kibana.

Screen Shot 2016-05-23 at 5.15.56 PM.png2606×1116 197 KB

6

Have you checked the mappings for each index to see if they are consistent?

7

What I've done to workaround this issue, is configured logstash to not create a new index everyday, but use the same index until this bug is fixed.

Since I only have one index now, there is not another index for me to compare mappings against. I believe this issue is the same issue addressed here: https://github.com/elastic/elasticsearch/issues/18135

Also, this thread probably belongs under the Elasticsearch section, as this is caused by ES, and not Kibana.

8

You can move topics by clicking the edit button beside the topic title :slight_smile:

9

And the error is back.. Workarounds have not worked.. The cluster is basically unusable after a day.

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

Does anyone have any clue when the fix for this might be released?

Screen Shot 2016-05-24 at 2.04.46 PM.png2438×734 86.8 KB

Screen Shot 2016-05-24 at 2.04.17 PM.png2598×1112 194 KB

10

Probably in the next alpha, not sure when that is scheduled though sorry.

11

Upgrading to Alpha 3 appears to have resolved this issue.

Thanks.