No mapping Found On [field] Sorting Issue

Elastic Stack Elasticsearch
1

Hi,

I'm currently experiencing a problem when I'm trying to search based on some specific field, I'm seeing this error log:

Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [process_id] in order to sort on.

I added a new custom mapping and rotated the indexes,

When I try curl -X GET 'http://localhost:9200/graylog_15/_search?pretty=true&sort='process_id'' (graylog_15 index was created after the rotation and contains the custom mapping for this process_id field) the problem is when I try to sort based on the same field in some old index.

image
image737×557 38.4 KB

Based on that I'm assuming that the custom mapping rules are only added to newly created indexes, so my question is: is it possible to update mapping rules for all old indexes so I can sort on logs that are included in old indexes?

My custom mapping.json looks like this:

{
"template": "graylog_9",
"mappings" : {
  "message" : {
    "properties" : {
      "winlogbeat_agent_type " : {
        "type" : "keyword"
      },
      "process_id" : {
      "type": "long"}
    }
  }
}
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.