Hello.
I have an index in kibana called poc1*, it contains fields of machineId and timestamp
I need to get from that index a maximum value of timestamp to a new index for each machineId (which is deviceId in sql).
It is working if I specify a certain machine (ma1). But when trying to join machineId to deviceId it fails with - Failed to query elasticsearch for previous event.
Any ideas? What am I doing wrong?
this is the full error log:
[3fc577f9e5c3f1bffc1199cd5f29ecdcd345d10b38736973b643f854c440f086] Failed to query elasticsearch for previous event {:index=>"poc1-2020.11.25", :error=>"[400] {\"error\":{\"root_cause\":[{\"type\":\"query_shard_exception\",\"reason\":\"Failed to parse query [MachineId:%{[deviceId]}]\",\"index_uuid\":\"-hEaWnQ-ThOunikXCMS9cg\",\"index\":\"poc1-2020.11.25\"}],\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"query\",\"grouped\":true,\"failed_shards\":[{\"shard\":0,\"index\":\"poc1-2020.11.25\",\"node\":\"p9GnWMV3RGiiE9AUHRD5Qg\",\"reason\":{\"type\":\"query_shard_exception\",\"reason\":\"Failed to parse query [MachineId:%{[deviceId]}]\",\"index_uuid\":\"-hEaWnQ-ThOunikXCMS9cg\",\"index\":\"poc1-2020.11.25\",\"caused_by\":{\"type\":\"parse_exception\",\"reason\":\"Cannot parse 'MachineId:%{[deviceId]}': Encountered \\\" \\\"]\\\" \\\"] \\\"\\\" at line 1, column 21.\\nWas expecting:\\n \\\"TO\\\" ...\\n \",\"caused_by\":{\"type\":\"parse_exception\",\"reason\":\"Encountered \\\" \\\"]\\\" \\\"] \\\"\\\" at line 1, column 21.\\nWas expecting:\\n \\\"TO\\\" ...\\n \"}}}}]},\"status\":400}"}
Thanks.