Kibana warning

Elastic Stack Kibana
1

Kibana is throwing below warning while loading

"Courier Fetch: 5 of 5 shards failed."

Below is the elasticsearch log

[2016-03-09 02:39:37,947][DEBUG][action.search.type ] [ELK-ES-CLUSTER-NODE1] [541751] Failed to execute fetch phase
RemoteTransportException[[ELK-ES-CLUSTER-NODE2][...:9300][indices:data/read/search[phase/fetch/id]]]; nested: ElasticsearchException[java.lang.IllegalStateException: Field data loading is forbidden on Date]; nested: NotSerializableExceptionWrapper[java.lang.IllegalStateException: Field data loading is forbidden on Date]; nested: IllegalStateException[Field data loading is forbidden on Date];
Caused by: ElasticsearchException[java.lang.IllegalStateException: Field data loading is forbidden on Date]; nested: NotSerializableExceptionWrapper[java.lang.IllegalStateException: Field data loading is forbidden on Date]; nested: IllegalStateException[Field data loading is forbidden on Date];

Kindly help me in fixing this issue.

2

Kibana uses the HTTP protocol, so must be configured to connect to port 9200, not 9300.

3

Thanks Christian for your quick response, Kindly guide me to configure this change.

4

Sorry, I misread and thought the error was in the Kibana log.

Which version of Elasticsearch and kibana are you using? How many nodes do you have in the cluster? What does your mapping for the index look like?

5

Versions
Elasticsearch - 2.1.1 ( 2 node cluster)
Kibana - 4.3.1

Part of Mapping info

_{"logstash-2016.03.09":{"mappings":{"sepm":{"all":{"enabled":true,"omit_norms":true},"dynamic_templates":[{"message_field":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string"},"match":"message","match_mapping_type":"string"}},{"string_fields":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string","doc_values":true}}},"match":"","match_mapping_type":"string"}},{"float_fields":{"mapping":{"type":"float","doc_values":true},"match":"","match_mapping_type":"float"}},{"double_fields":{"mapping":{"type":"double","doc_values":true},"match":"","match_mapping_type":"double"}},{"byte_fields":{"mapping":{"type":"byte","doc_values":true},"match":"","match_mapping_type":"byte"}},{"short_fields":{"mapping":{"type":"short","doc_values":true},"match":"","match_mapping_type":"short"}},{"integer_fields":{"mapping":{"type":"integer","doc_values":true},"match":"","match_mapping_type":"integer"}},{"long_fields":{"mapping":{"type":"long","doc_values":true},"match":"","match_mapping_type":"long"}},{"date_fields":{"mapping":{"type":"date","doc_values":true},"match":"","match_mapping_type":"date"}},{"geo_point_fields":{"mapping":{"type":"geo_point","doc_values":true},"match":"*","match_mapping_type":"geo_point"}}],"properties":{"@timestamp":{"type":"date","format":"strict_date_optional_time||epoch_millis"},"@version":{"type":"string","index":"not_analyzed"},"Begin_Date":{"type":"string","norms":{"enabled":false},"fielddata":{"format":"disabled"},"fields":{"raw":{"type":"string","index":"not_analyzed","ignore_above":256}}},

6

I have seen following conflict at Kibana dashboard

"Mapping conflict! A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data."

and i have noticed below warning for one of the fields in Indices tab.

7

That conflict is a normal error to see if the field received_at is defined as different types in different indices. From the previous messages, it seems like your mappings may be in a bad state. Is elasticsearch starting up ok? Are you getting any actual errors in your elasticsearch logs?