All,
I upgraded to elasticsearch 1.0 this morning (the upgrade went very
smoothly). I pulled-up Kibana and saw my normal dashboard - terms,
histogram, and table panels all loaded the expected data.
However, when I try to add filters to the search everything blows up. I'm
hoping that someone can help me track down why this is happening.
Logs:
Kibana loads just fine - terms, histogram and table all show the expected
data:
[14/Feb/2014:09:13:16 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "GET
/kibana-int/dashboard/Log%20Viewer?1392387196896 HTTP/1.1" 3293
[14/Feb/2014:09:13:17 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "GET
/logstash-2014.02.14,logstash-2014.02.14/_aliases?ignore_missing=true
HTTP/1.1" 56
[14/Feb/2014:09:13:17 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "GET
/logstash-2014.02.14/_mapping HTTP/1.1" 698
[14/Feb/2014:09:13:17 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "POST
/logstash-2014.02.14/_search?search_type=count HTTP/1.1" 654
[14/Feb/2014:09:13:17 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "POST
/logstash-2014.02.14/_search HTTP/1.1" 209
[14/Feb/2014:09:13:17 -0500] 1.2.3.4 TLSv1.2 DHE-RSA-AES256-SHA256 "POST
/logstash-2014.02.14/_search HTTP/1.1" 68847
If I try to perform a search for:
field must
field : action
query : "REGISTER"
Then I get the following error back from Kibana:
Oops! SearchParseException[[logstash-2014.02.14][2]: from[-1],size[-1]:
Parse Failure [Failed to parse source
[{"query":{"filtered":{"query":{"bool":{"should":[{"query_string":{"query":"*"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1392386184987,"to":"now"}}},{"fquery":{"query":{"field":{"action":{"query":""REGISTER""}}},"_cache":true}}]}}}},"highlight":{"fields":{"type":{}},"fragment_size":2147483647,"pre_tags":["@start-highlight@"],"post_tags":["@end-highlight@"]},"size":1000,"sort":[{"@timestamp":{"order":"desc"}}]}]]]
# The elasticsearch logs show the following:
[2014-02-14 09:11:24,992][DEBUG][action.search.type ] [es1]
[logstash-2014.02.14][1], node[UuiFJ2izTeuhfUFlFiz_RA], [R], s[STARTED]:
Failed to execute [org.elasticsearch.action.search.SearchRequest@1f977bb3]
lastShard [true]
org.elasticsearch.transport.RemoteTransportException:
[es2][inet[/5.6.7.8:9300]][search/phase/query]
Caused by: org.elasticsearch.search.SearchParseException:
[logstash-2014.02.14][1]: from[-1],size[-1]: Parse Failure [Failed to parse
source
[{"query":{"filtered":{"query":{"bool":{"should":[{"query_string":{"query":"*"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1392386184987,"to":"now"}}},{"fquery":{"query":{"field":{"action":{"query":""REGISTER""}}},"_cache":true}}]}}}},"highlight":{"fields":{"type":{}},"fragment_size":2147483647,"pre_tags":["@start-highlight@"],"post_tags":["@end-highlight@"]},"size":1000,"sort":[{"@timestamp":{"order":"desc"}}]}]]
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:586)
at
org.elasticsearch.search.SearchService.createContext(SearchService.java:489)
at
org.elasticsearch.search.SearchService.createContext(SearchService.java:474)
at
org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:467)
at
org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:239)
at
org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:623)
at
org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:612)
at
org.elasticsearch.transport.netty.MessageChannelHandler$RequestHandler.run(MessageChannelHandler.java:270)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:744)
Caused by: org.elasticsearch.index.query.QueryParsingException:
[logstash-2014.02.14] No query registered for [field]
at
org.elasticsearch.index.query.QueryParseContext.parseInnerQuery(QueryParseContext.java:221)
at
org.elasticsearch.index.query.FQueryFilterParser.parse(FQueryFilterParser.java:66)
at
org.elasticsearch.index.query.QueryParseContext.executeFilterParser(QueryParseContext.java:279)
at
org.elasticsearch.index.query.QueryParseContext.parseInnerFilter(QueryParseContext.java:260)
at
org.elasticsearch.index.query.BoolFilterParser.parse(BoolFilterParser.java:92)
at
org.elasticsearch.index.query.QueryParseContext.executeFilterParser(QueryParseContext.java:279)
at
org.elasticsearch.index.query.QueryParseContext.parseInnerFilter(QueryParseContext.java:260)
at
org.elasticsearch.index.query.FilteredQueryParser.parse(FilteredQueryParser.java:74)
at
org.elasticsearch.index.query.QueryParseContext.parseInnerQuery(QueryParseContext.java:223)
at
org.elasticsearch.index.query.IndexQueryParserService.parse(IndexQueryParserService.java:321)
at
org.elasticsearch.index.query.IndexQueryParserService.parse(IndexQueryParserService.java:260)
at
org.elasticsearch.search.query.QueryParseElement.parse(QueryParseElement.java:33)
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:574)
... 10 more
[2014-02-14 09:11:24,992][DEBUG][action.search.type ] [es1] All
shards failed for phase: [query]
I have a 3 node cluster - 2 machines are data nodes. I tried shutting
down various combinations of elasticsearch servers and I get the same
error.
Copying/pasting the same query into Marvel Sense shows the same issue.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/96d42e01-151c-45ec-84a0-66ad7e7b7f6e%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
