Error: [illegal_state_exception] trying to merge the field stats of field

After setting up a new Elasticsearch 5 Alpha 2 cluster, and redirecting our logstash pipe to send logs to this new cluster, I'm getting this error in Kibana:

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016.05.22] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

This error shows up when I open the Discover tab in Kibana.

It looks like this is a known issue.. Is there a work around so my team can continue to use Kibana until the next release?

Best I can tell, this is an issue with the mappings in your indices not matching quite right. See https://github.com/elastic/elasticsearch/issues/18135

Meaning, mappings in some indices, differ from mappings in other indices? This shouldn't be the case, as there was no preexisting data before I started sending data in from logstash on the new cluster.

I've gotten past the error, hopefully for good... This is how:

  1. Stopped the Logstash pipeline
  2. Deleted all logstash-* indices, (2 days worth)
  3. Deleted the logstash pattern in Kibana
  4. Re-started logstash pipline
  5. Re-created logstash index pattern

Now I'm able to explore in Kibana and I don't see the error.. I'll update this thread if the issue comes back.

In hindsight, it may be wise to just delete the index mentioned in the exception.

1 Like

The error has come back:

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016.05.23] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

It seems like if there is only one Logstash index, Kibana works fine, but as soon as logstash creates a new index, this error comes up on the explore tab and we're unable to use kibana.

Have you checked the mappings for each index to see if they are consistent?

What I've done to workaround this issue, is configured logstash to not create a new index everyday, but use the same index until this bug is fixed.

Since I only have one index now, there is not another index for me to compare mappings against. I believe this issue is the same issue addressed here: https://github.com/elastic/elasticsearch/issues/18135

Also, this thread probably belongs under the Elasticsearch section, as this is caused by ES, and not Kibana.

You can move topics by clicking the edit button beside the topic title :slight_smile:

And the error is back.. Workarounds have not worked.. The cluster is basically unusable after a day.

Error: [illegal_state_exception] trying to merge the field stats of field [@timestamp] from index [logstash-2016] but the field type is incompatible, try to set the 'level' option to 'indices' at respond (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:27112) at checkRespForFailure (https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:26340) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:75:5070 at processQueue (https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23627) at https://10.40.10.118/bundles/commons.bundle.js?v=12279:38:23894 at Scope.$eval (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:4619) at Scope.$digest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:2359) at Scope.$apply (https://10.40.10.118/bundles/commons.bundle.js?v=12279:39:5037) at done (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:25027) at completeRequest (https://10.40.10.118/bundles/commons.bundle.js?v=12279:37:28702)

Does anyone have any clue when the fix for this might be released?


Probably in the next alpha, not sure when that is scheduled though sorry.

Upgrading to Alpha 3 appears to have resolved this issue.

Thanks.