No mapping found for [@timestamp] in order to sort on

Elastic Stack Elasticsearch
1

Hi,

I have next error on all search queries:
[2016-04-16 21:14:45,049][INFO ][rest.suppressed ] /vastuf-vm-containers-/_search Params: {size=10000, ignore_unavailable=true, _source_include=@timestamp,, index=vastuf-vm-containers-*}
Failed to execute phase [query], all shards failed; shardFailures {[AcpTZc27Q9mC6msfZUsvsw][vastuf-vm-containers-2016-04-16][0]: RemoteTransportException[[hose][172.17.0.4:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"sort": [{"@timestamp": {"order": "asc"}}], "query": {"filtered": {"filter": {"bool": {"must": [{"range": {"@timestamp": {"gt": "2016-04-16T20:59:45.044337Z", "lte": "2016-04-16T21:14:45.044337Z"}}}]}}}}}]]; nested: SearchParseException[No mapping found for [@timestamp] in order to sort on]; }...

Here is mapping for this index:
"vastuf-vm-containers-2016-04-16": {
"mappings": {
"containers": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"notanalyzed": {
"mapping": {
"index": "not_analyzed",
"type": "string"
},
"match": "*",
"match_mapping_type": "string"
}
}
],
"properties": {
"instance_name": {
"type": "string",
"index": "not_analyzed"
},
"name": {
"type": "string",
"index": "not_analyzed"
},
"status": {
"type": "string",
"index": "not_analyzed"
},
"timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"version": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}

I thought that dynamic_templates could affect but there are declare timestamp property with type date.

So what could be the reason of this error?

2

Like it says, you have no @timestamp.
Try using timestamp instead.

3

Argh, stupid error. I thought that @ is a special symbol to specify fields. Thanks, it works now.

4

@ is used by Logstash as a metafield, it's not reserved as such.