# No matching token for number\_type \[BIG\_INTEGER\] **URL:** \ **Category:** Elasticsearch\ **Created:** [April 29, 2016, 3:05am UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759 "2016-04-29T03:05:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [April 29, 2016, 3:05am UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/1 "2016-04-29T03:05:05Z")
- Stopped our logstash indexer - Dropped today's index - Altered the template inorder to set type of a specific previous dynamic field as a string type, since it some time caused index to be created with this dynamic fieled as a long and thus maybe gave field type conflicts. - Started the logstash indexer - Got a new index of today auto created - Verified field now is mapped as a string - Went to Kibana and got this error: Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"illegal\_state\_exception","reason":"No matching token for number\_type [BIG\_INTEGER]"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query\_fetch","grouped":true,"failed\_shards":[{"shard":0,"index":"owmlog-2016.04.29","node":"gSLxsnTgS5iPcZtuhdlC3A","reason":{"type":"illegal\_state\_exception","reason":"No matching token for number\_type [BIG\_INTEGER]"}}]}} Tried to drop and recreate index a few times with same result, why? ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [April 30, 2016, 8:01am UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/2 "2016-04-30T08:01:46Z")
Wondering if the BIG\_NUMBER is a Kibana issue or ES, any ideas? Kibana 4.5.0 only sees 4 fields as numbers from ES:2.3.1 > nodePort number Edit > port number Edit > time number Edit > \_score number Edit How could I dig further down to find the data causing this? ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 3, 2016, 11:10am UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/3 "2016-05-03T11:10:05Z")
Seems to have disappear again after patching all my ES nodes to 2.3.2-1 inlcuding my tribe node on the kibana host 😌 ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 3, 2016, 9:29pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/4 "2016-05-03T21:29:50Z")
A bit to soon to cheer 😕, it appeared again, hints on how to drill down to figure out why this is triggered appreciated! > Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"illegal\_state\_exception","reason":"No matching token for number\_type [BIG\_INTEGER]"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query\_fetch","grouped":true,"failed\_shards":[{"shard":0,"index":"popserv-2016.05.03","node":"lfWys2RkT9uuTCAz0lcmww","reason":{"type":"illegal\_state\_exception","reason":"No matching token for number\_type [BIG\_INTEGER]"}}]}} > KbnError@https:///bundles/commons.bundle.js?v=9889:61319:30 > RequestFailure@https:///bundles/commons.bundle.js?v=9889:61352:19 > https:///bundles/kibana.bundle.js?v=9889:89385:57 > https:///bundles/commons.bundle.js?v=9889:63863:28 > https:///bundles/commons.bundle.js?v=9889:63832:31 > map@[native code] > map@https:///bundles/commons.bundle.js?v=9889:63831:34 > callResponseHandlers@https:///bundles/kibana.bundle.js?v=9889:89357:26 > https:///bundles/kibana.bundle.js?v=9889:88862:37 > processQueue@https:///bundles/commons.bundle.js?v=9889:41836:31 > https:///bundles/commons.bundle.js?v=9889:41852:40 > $eval@https:///bundles/commons.bundle.js?v=9889:43080:29 > $digest@https:///bundles/commons.bundle.js?v=9889:42891:37 > $apply@https:///bundles/commons.bundle.js?v=9889:43188:32 > done@https:///bundles/commons.bundle.js?v=9889:37637:54 > completeRequest@https:///bundles/commons.bundle.js?v=9889:37835:16 > requestLoaded@https:///bundles/commons.bundle.js?v=9889:37776:25 ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 25, 2016, 9:53am UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/5 "2016-05-25T09:53:24Z")
Nailed it done to documents like this: ``` {"_index":"popserv-2016.05.25","_type":"popserv","_id":"AVTnEhpwWvfOjJPMxwwj","_score":1.2420747, "_source": {"message":"","@timestamp":"2016-05-25T08:39:57.292Z","tags":[], "type":"popserv","host":"","lglvl":"Note","event":"PopConnMade","user":, "mbox":9xxxxxxxxxxxxxxxxxxx, "cmd":"","fromhost":"", "geoip":{"country_name":"","continent_code":"EU","city_name":"","location":[xx.520100000000014,yy.39019999999999],"ip":""}, "geoasn":{"number":"","asn":""} } } ``` And have this template for the index: ``` { "template":"popserv-*", "settings":{"index":{"number_of_shards":1,"numver_replicas":1,"refresh_interval":"5s"}}, "mappings":{ "_default_":{ "dynamic_templates":[{ "template1":{ "mapping":{"ignore_above":64,"index":"not_analyzed","omit_norms":"true","type":"{dynamic_type}","doc_values":true}, "match":"*"} }], "_all":{"norms":{"enabled":false},"enabled":true}, "properties":{ "@timestamp":{"type":"date"}, "host":{"index":"not_analyzed","omit_norms":"true","type":"string"}, "user":{"index":"not_analyzed","omit_norms":"true","type":"string"}, "mbox":{"index":"not_analyzed","omit_norms":"true","type":"string"}, "event":{"index":"not_analyzed","omit_norms":"true","type":"string"}, "type":{"index":"not_analyzed","omit_norms":"true","type":"string"}, "geoip":{"properties":{"location":{"type":"geo_point"},"ip":{"type":"ip","omit_norms":true,"index":"not_analyzed"}}}, "fromhost":{"index":"not_analyzed","omit_norms":"true","type":"ip"} } } }, "aliases":{} } ``` My concern are that the mbox field isn't made a string as template says since it it's value isn't quoted '"' like other string fields and that 20 digit numbers cause this BIG\_INTEGER issue. Am I right it's not a string when not returned '"' quoted and if so, how can I force this field to be made a string if not by my template? Don't suppose query parameter 'lenient' cant help if possible to use from kibana either? ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 25, 2016, 12:56pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/6 "2016-05-25T12:56:47Z")
The Mapping API says mbox is a string as expected, but why do a query return unquoted values then... or am I barking up the wrong tree with this BIG\_INTEGER though I'm pretty sure it docs like this that break kibana queries... ``` [root@cbdA ~]# curl -XGET 'http://localhost:9200/popserv-2016.05.25/_mapping' {"popserv-2016.05.25":{ "mappings":{ "popserv":{"_all":{"enabled":true,"omit_norms":true}, "dynamic_templates":[{"template1":{"mapping":{"ignore_above":64,"index":"not_analyzed","omit_norms":"true","type":"{dynamic_type}","doc_values":true},"match":"*"}}], "properties":{ "@timestamp":{"type":"date","format":"strict_date_optional_time||epoch_millis"}, "cmd":{"type":"string","index":"not_analyzed","ignore_above":64}, "dirdelay":{"type":"long"},"event":{"type":"string","index":"not_analyzed"}, "fromhost":{"type":"ip"}, "geoasn":{"properties":{"asn":{"type":"string","index":"not_analyzed","ignore_above":64},"number":{"type":"string","index":"not_analyzed","ignore_above":64}}}, "geoip":{"properties":{"city_name":{"type":"string","index":"not_analyzed","ignore_above":64},"continent_code":{"type":"string","index":"not_analyzed","ignore_above":64},"country_name":{"type":"string","index":"not_analyzed","ignore_above":64},"ip":{"type":"ip"},"location":{"type":"geo_point"}}}, "host":{"type":"string","index":"not_analyzed"}, "lglvl":{"type":"string","index":"not_analyzed","ignore_above":64}, "mbox":{"type":"string","index":"not_analyzed"}, "message":{"type":"string","index":"not_analyzed","ignore_above":64}, "msgid":{"type":"string","index":"not_analyzed","ignore_above":64}, "mss":{"type":"string","index":"not_analyzed","ignore_above":64}, "node":{"type":"string","index":"not_analyzed","ignore_above":64}, "nodePort":{"type":"long"}, "port":{"type":"long"}, "size":{"type":"long"}, "time":{"type":"long"}, "type":{"type":"string","index":"not_analyzed"}, "user":{"type":"string","index":"not_analyzed"}}}, "_default_":{"_all":{"enabled":true,"omit_norms":true}, "dynamic_templates":[{"template1":{"mapping":{"ignore_above":64,"index":"not_analyzed","omit_norms":"true","type":"{dynamic_type}","doc_values":true},"match":"*"}}], "properties":{ "@timestamp":{"type":"date","format":"strict_date_optional_time||epoch_millis"}, "event":{"type":"string","index":"not_analyzed"}, "fromhost":{"type":"ip"}, "geoip":{"properties":{"ip":{"type":"ip"},"location":{"type":"geo_point"}}}, "host":{"type":"string","index":"not_analyzed"}, "mbox":{"type":"string","index":"not_analyzed"}, "type":{"type":"string","index":"not_analyzed"}, "user":{"type":"string","index":"not_analyzed"}}} }}} ``` ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 25, 2016, 1:13pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/7 "2016-05-25T13:13:50Z")
If I index a doc and prefix my large number for mbox field with some letters then query API returns a '"' quoted value and thus kibana sees no issue with BIG\_INTEGER... seems a bug to me that ES tries to return a number though the type is mapped as a string, just because it see only numbers in the string value... How to report this bug... I wonder ``` [root@cbdA ~]# curl -XGET 'http://localhost:9200/popserv-2016.05.25/_search?q=mbox=id9' {..."mbox":"id9xxxxxxxxxxxxxxxxxxx"...} ``` ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [May 25, 2016, 1:50pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/8 "2016-05-25T13:50:11Z")
😊 it's not a ES bug, it's my own mistake, had a logstash filter that splits key/value pairs into fields with this ruby bit: ``` k = kvs[0] v = kvs[1] if v.match('\A\d+\Z') event[k] = v.to_i elsif v.match('\A\d+\.\d+\Z') event[k] = v.to_f else event[k] = v end ``` changing it to this seems to avoid large integers ``` k = kvs[0] v = kvs[1] if v.match('\A\d+\Z') and v.length <= 18 event[k] = v.to_i elsif v.match('\A\d+\.\d+\Z') event[k] = v.to_f else event[k] = v end ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:49pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer/48759/9 "2017-07-05T22:49:03Z")