Marvel fails on fresh install (Windows)

Elastic Stack Elasticsearch
1

I'm starting an ES cluster on Windows, still on first node. ES & Logstash
are running fine, but Marvel is failing with a "Failed to parse source"
against the @timestamp field.
I've uninstalled, reinstalled, restarted. I checked the indices and
.marvel-YYYY.MM.DD is there and has data in it.
Any help on how to tshoot further is much appreciated. Trying to demo so
we can purchase, but stuck on this.
Thanks, Rick

[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong]
[.marvel-2015.03.04][0], node[XtdYbJwaQQSLJbYTfMPA4g], [R], s[STARTED]:
Failed to execute [org.elasticsearch.action.search.SearchRequest@1ba00061]
org.elasticsearch.search.SearchParseException: [.marvel-2015.03.04][0]:
from[-1],size[1]: Parse Failure [Failed to parse source
[{"size":1,"sort":{"@timestamp":{"order":"desc"}}}]]
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:687)
at
org.elasticsearch.search.SearchService.createContext(SearchService.java:543)
at
org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:515)
at
org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:356)
at
org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:333)
at
org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:330)
at
org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: org.elasticsearch.search.SearchParseException:
[.marvel-2015.03.04][0]: from[-1],size[1]: Parse Failure [No mapping found
for [@timestamp] in order to sort on]
at
org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:210)
at
org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:184)
at
org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:671)
... 9 more
[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong]
All shards failed for phase: [query_fetch]

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8ad8029c-0e64-496a-9fb6-0e1c4b01d4a8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Hi Rick,

Sorry for the late response. This one slipped through. Do you still have
the issue? Marvel needs to be installed on all the nods in the cluster.
Missing installing it on the master will cause this kind of errors.

Cheers,
Boaz

On Wednesday, March 4, 2015 at 7:06:35 PM UTC+1, Rick wrote:

I'm starting an ES cluster on Windows, still on first node. ES & Logstash
are running fine, but Marvel is failing with a "Failed to parse source"
against the @timestamp field.
I've uninstalled, reinstalled, restarted. I checked the indices and
.marvel-YYYY.MM.DD is there and has data in it.
Any help on how to tshoot further is much appreciated. Trying to demo so
we can purchase, but stuck on this.
Thanks, Rick

[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong]
[.marvel-2015.03.04][0], node[XtdYbJwaQQSLJbYTfMPA4g], [R], s[STARTED]:
Failed to execute [org.elasticsearch.action.search.SearchRequest@1ba00061]
org.elasticsearch.search.SearchParseException: [.marvel-2015.03.04][0]:
from[-1],size[1]: Parse Failure [Failed to parse source
[{"size":1,"sort":{"@timestamp":{"order":"desc"}}}]]
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:687)
at
org.elasticsearch.search.SearchService.createContext(SearchService.java:543)
at
org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:515)
at
org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:356)
at
org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:333)
at
org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:330)
at
org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: org.elasticsearch.search.SearchParseException:
[.marvel-2015.03.04][0]: from[-1],size[1]: Parse Failure [No mapping found
for [@timestamp] in order to sort on]
at
org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:210)
at
org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:184)
at
org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at
org.elasticsearch.search.SearchService.parseSource(SearchService.java:671)
... 9 more
[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong]
All shards failed for phase: [query_fetch]

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/32b513b3-6d80-49b4-b00d-774f82dc5272%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

3

Thanks, this was the first node, there weren't any others. I finally reinstalled several times and deleted all the data files. So far so good.
-Rick

On Mar 21, 2015, at 12:44 PM, Boaz Leskes b.leskes@gmail.com wrote:

Hi Rick,

Sorry for the late response. This one slipped through. Do you still have the issue? Marvel needs to be installed on all the nods in the cluster. Missing installing it on the master will cause this kind of errors.

Cheers,
Boaz

On Wednesday, March 4, 2015 at 7:06:35 PM UTC+1, Rick wrote:
I'm starting an ES cluster on Windows, still on first node. ES & Logstash are running fine, but Marvel is failing with a "Failed to parse source" against the @timestamp field.
I've uninstalled, reinstalled, restarted. I checked the indices and .marvel-YYYY.MM.DD is there and has data in it.
Any help on how to tshoot further is much appreciated. Trying to demo so we can purchase, but stuck on this.
Thanks, Rick

[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong] [.marvel-2015.03.04][0], node[XtdYbJwaQQSLJbYTfMPA4g], [R], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@1ba00061]
org.elasticsearch.search.SearchParseException: [.marvel-2015.03.04][0]: from[-1],size[1]: Parse Failure [Failed to parse source [{"size":1,"sort":{"@timestamp":{"order":"desc"}}}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:687)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:543)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:515)
at org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:356)
at org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:333)
at org.elasticsearch.search.action.SearchServiceTransportAction$11.call(SearchServiceTransportAction.java:330)
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: org.elasticsearch.search.SearchParseException: [.marvel-2015.03.04][0]: from[-1],size[1]: Parse Failure [No mapping found for [@timestamp] in order to sort on]
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:210)
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:184)
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:671)
... 9 more
[2015-03-04 12:03:42,981][DEBUG][action.search.type ] [Doctor Bong] All shards failed for phase: [query_fetch]

--
You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elasticsearch/Kodn9B0vPso/unsubscribe.
To unsubscribe from this group and all its topics, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/32b513b3-6d80-49b4-b00d-774f82dc5272%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/C4F98E22-7C8C-4374-AFCE-1056991AB190%40gmail.com.
For more options, visit https://groups.google.com/d/optout.