How to stop datafeed

[Thanadol_Thadasade]

Hi, I having issue about datafeed.
I can't stop datafeed and delete it.

This error in kibana command.

error [10:34:54.287] [null_pointer_exception] null :: {"path":"/_xpack/ml/datafeeds/datafeed-alert-mem/_stop","query":{},"statusCode":500,"response":"{"error":{"root_cause":[{"type":"null_pointer_exception","reason":null}],"type":"null_pointer_exception","reason":null},"status":500}"}
at respond (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\transport.js:295:15)
at checkRespForFailure (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\transport.js:254:7)
at HttpConnector. (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\src\lib\connectors\http.js:157:7)
at IncomingMessage.bound (C:\Users\dol_n\Downloads\kibana-5.4.1-windows-x86\node_modules\elasticsearch\node_modules\lodash\dist\lodash.js:729:21)
at emitNone (events.js:91:20)
at IncomingMessage.emit (events.js:185:7)
at endReadableNT (_stream_readable.js:974:12)
at _combinedTickCallback (internal/process/next_tick.js:80:11)
at process._tickDomainCallback (internal/process/next_tick.js:128:9)

i hope anyone can help me.
thanks.

[dkyle (David Kyle)]

Hi,

Is it possible for you to share your elasticsearch.log file and the version of x-pack you are using? That will help us understand the issue.

Thanks

[Thanadol_Thadasade]

thank for the quick reply @dkyle.
I used elasticsearch, kibana and x-pack version 5.4.1 .

And example elasticsearch.log.

[2017-07-14T17:34:53,375][WARN ][r.suppressed ] path: /_xpack/ml/datafeeds/datafeed-alert-mem/_stop, params: {datafeed_id=datafeed-alert-mem}
java.lang.NullPointerException: null
at org.elasticsearch.cluster.node.DiscoveryNodes.isAllNodes(DiscoveryNodes.java:232) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.cluster.node.DiscoveryNodes.resolveNodes(DiscoveryNodes.java:290) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction.resolveNodes(TransportTasksAction.java:167) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction$AsyncAction.(TransportTasksAction.java:246) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction$AsyncAction.(TransportTasksAction.java:231) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.support.tasks.TransportTasksAction.doExecute(TransportTasksAction.java:104) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.ml.action.StopDatafeedAction$TransportAction.doExecute(StopDatafeedAction.java:351) ~[?:?]
at org.elasticsearch.xpack.ml.action.StopDatafeedAction$TransportAction.doExecute(StopDatafeedAction.java:265) ~[?:?]
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:170) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$apply$1(SecurityActionFilter.java:128) ~[?:?]
at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:59) ~[elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$authorizeRequest$4(SecurityActionFilter.java:203) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.maybeRun(AuthorizationUtils.java:127) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.setRunAsRoles(AuthorizationUtils.java:121) ~[?:?]
at org.elasticsearch.xpack.security.authz.AuthorizationUtils$AsyncAuthorizer.authorize(AuthorizationUtils.java:109) ~[?:?]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.authorizeRequest(SecurityActionFilter.java:205) ~[?:?]
at org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$applyInternal$3(SecurityActionFilter.java:181) ~[?:?]

thanks.

[dkyle (David Kyle)]

Thanks for the log file.

Machine Learning in X-Pack GA'd in the 5.5 release. Version 5.4.1 is a beta release. I really recommend upgrading to 5.5 where you will benefit from a number of improvements.

Are you running on a multi-node cluster? From the snippet of the log file it appears the datafeed has already stopped - possibly because the node it was running on left the cluster.

[Thanadol_Thadasade]

Sorry for late @dkyle.
I don't want to tried latest version now, because elasticsearch has rapid development.

And now i can't stop datafeed state (alert-mem created by multi-job).

from you tell me about node on left cluster how to stop it ?

thanks

[dkyle (David Kyle)]

Hi,

I think the issue is that the datafeed is reported as being in the started state but it is actually stopped. You can check this via the Task API. If the datafeed is running you will see a task named datafeed-alert-mem.

The root cause of the issue is fixed in 5.5 so again I would encourage you to upgrade. Version 5.5 also has a force delete option which would help in this situation.

If you can't upgrade you can continue to create new jobs and datafeeds, the existing alert-mem datafeed won't affect any new jobs. I'm sorry you are having these problems I recommend creating a new multi-metric job and exploring the ML features in a new job.

[Thanadol_Thadasade]

OK, I understand and thanks you very much @dkyle .