Exeption in mapping

What can be the reason of such exception?

"reason":{"type":"exception","reason":"Elasticsearch exception [type=query_shard_exception, reason=No mapping found for [timeStamp] in order to sort on]","index_uuid":"EwqLKS3ZTDqlGdqfuHHi5w","index":".kibana"}}]},"hits":{"total":3,"max_score":null,"hits":[{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"Vh5zUGEBAUNy8RN4gRLf","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]},{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"Vx5zUGEBAUNy8RN4hRLJ","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]},{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"VR5zUGEBAUNy8RN4fxIq","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]}]}}

This is logs fro ES server:

[2018-02-01T02:46:51,407][DEBUG][o.e.a.s.TransportSearchAction] [node-43] [portal-user-26.01.2018][3], node[SAPKQLGGSJiR8bMBdkNvfQ], [P], s[STARTED], a[id=9d6qWfW3SWaigflL9TCmmw]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[], indicesOptions=IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false], types=[], routing='null', preference='null', requestCache=null, scroll=null, maxConcurrentShardRequests=10, batchedReduceSize=512, preFilterShardSize=128, source={"from":0,"size":20,"query":{"bool":{"filter":[{"match_phrase":{"header":{"query":"test Header 15","slop":0,"boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"sort":[{"timeStamp":{"order":"desc"}}]}}]
org.elasticsearch.transport.RemoteTransportException: [node-70][192.168.3.70:9300][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [timeStamp] in order to sort on
 at org.elasticsearch.search.sort.FieldSortBuilder.build(FieldSortBuilder.java:319) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.sort.SortBuilder.buildSort(SortBuilder.java:155) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService.parseSource(SearchService.java:718) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService.createContext(SearchService.java:552) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:528) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:324) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:310) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:306) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.search.SearchService$3.doRun(SearchService.java:996) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:637) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) ~[elasticsearch-6.1.2.jar:6.1.2]
 at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.1.2.jar:6.1.2]
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_162]
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_162]
 at java.lang.Thread.run(Thread.java:748) [?:1.8.0_162]

I have such mapping:

  PUT _template/portal-logs
{
  "template": "portal-logs-*",
  "settings": { "number_of_shards": 5 },
  "mappings": {
      "logs_info": {
        "_all": {
          "enabled": false
        },
        "properties": {
          "device": {"type": "keyword"},
          "header": {"type": "text"},
          "ip": {"type": "keyword"},
          "level": {"type": "text"},
          "location": {"type": "geo_point"},
          "message": {"type": "text"},
          "module": {"type": "keyword"},
          "node": {"type": "keyword"},
          "office": {"type": "keyword"},
          "operation": {"type": "keyword"},
          "port": {"type": "integer"},
          "sessionId": {"type": "keyword"},
          "submodule": {"type": "keyword"},
          "system": {"type": "keyword"},
          "thread": {"type": "keyword"},
          "timeStamp": {"type": "date"},
          "userLogin": {"type": "keyword"},
          "userName": {"type": "keyword"}
        }
      }
    }
  }

and this is a part of the code:

 sourceBuilder.query(bqb)
                .size(pageable.getPageSize()).from(pageable.getOffset())
                .sort(new FieldSortBuilder("timeStamp").order(SortOrder.DESC));

Can you run:

GET portal-logs-01.02.2018/_mapping
    {
      "portal-logs-01.02.2018": {
        "mappings": {
          "logs_info": {
            "_all": {
              "enabled": false
            },
            "properties": {
              "device": {
                "type": "keyword"
              },
              "header": {
                "type": "text"
              },
              "ip": {
                "type": "keyword"
              },
              "level": {
                "type": "text"
              },
              "location": {
                "type": "geo_point"
              },
              "message": {
                "type": "text"
              },
              "module": {
                "type": "keyword"
              },
              "node": {
                "type": "keyword"
              },
              "office": {
                "type": "keyword"
              },
              "operation": {
                "type": "keyword"
              },
              "port": {
                "type": "integer"
              },
              "sessionId": {
                "type": "keyword"
              },
              "submodule": {
                "type": "keyword"
              },
              "system": {
                "type": "keyword"
              },
              "thread": {
                "type": "keyword"
              },
              "timeStamp": {
                "type": "date"
              },
              "userLogin": {
                "type": "keyword"
              },
              "userName": {
                "type": "keyword"
              }
            }
          }
        }
      }
}

Oh! I understand.

The thing is that you are searching here on all indices.

And .kibana index does not have this field. You need to search only on portal-logs-* indices.

And how I can specify indeces in Java code?

You can pass it when you create the search request object.

SearchRequest searchRequest = new SearchRequest("portal-logs-*");
That helps.
Thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.