org.elasticsearch.index.query.QueryShardException: failed to create query using kibana

I have a newly setup Elasticsearch cluster and kibana pointing to it. When I just click on the discovery tab to view the data it just hangs forever and ever, when looking into the ES logs more I see the following error:

Caused by: org.elasticsearch.index.query.QueryShardException: failed to create query: {
  "bool" : {
    "filter" : [
      {
        "match_all" : {
          "boost" : 1.0
        }
      },
      {
        "range" : {
          "@timestamp" : {
            "from" : "2020-01-23T18:17:43.891Z",
            "to" : "2020-01-23T18:32:43.891Z",
            "include_lower" : true,
            "include_upper" : true,
            "format" : "strict_date_optional_time",
            "boost" : 1.0
          }
        }
      }
    ],
    "adjust_pure_negative" : true,
    "boost" : 1.0
  }
}
	at org.elasticsearch.index.query.QueryShardContext.toQuery(QueryShardContext.java:347) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.QueryShardContext.toQuery(QueryShardContext.java:330) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.parseSource(SearchService.java:745) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.createContext(SearchService.java:586) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:545) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:348) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.lambda$executeQueryPhase$1(SearchService.java:340) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionListener.lambda$map$2(ActionListener.java:146) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:58) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionRunnable$2.doRun(ActionRunnable.java:73) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:44) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:773) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.5.2.jar:7.5.2]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
	at java.lang.Thread.run(Thread.java:830) [?:?]
Caused by: java.lang.NumberFormatException: For input string: "2020-01-23T18:17:43.891Z"
	at jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:2054) ~[?:?]
	at jdk.internal.math.FloatingDecimal.parseDouble(FloatingDecimal.java:110) ~[?:?]
	at java.lang.Double.parseDouble(Double.java:549) ~[?:?]
	at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType.objectToDouble(NumberFieldMapper.java:876) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType.access$200(NumberFieldMapper.java:173) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType$7.parse(NumberFieldMapper.java:693) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.mapper.NumberFieldMapper$NumberType$7.rangeQuery(NumberFieldMapper.java:755) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.mapper.NumberFieldMapper$NumberFieldType.rangeQuery(NumberFieldMapper.java:944) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.mapper.SimpleMappedFieldType.rangeQuery(SimpleMappedFieldType.java:52) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.RangeQueryBuilder.doToQuery(RangeQueryBuilder.java:507) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.AbstractQueryBuilder.toQuery(AbstractQueryBuilder.java:99) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.BoolQueryBuilder.addBooleanClauses(BoolQueryBuilder.java:394) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.BoolQueryBuilder.doToQuery(BoolQueryBuilder.java:381) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.AbstractQueryBuilder.toQuery(AbstractQueryBuilder.java:99) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.QueryShardContext.lambda$toQuery$1(QueryShardContext.java:331) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.QueryShardContext.toQuery(QueryShardContext.java:343) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.index.query.QueryShardContext.toQuery(QueryShardContext.java:330) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.parseSource(SearchService.java:745) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.createContext(SearchService.java:586) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:545) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:348) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.search.SearchService.lambda$executeQueryPhase$1(SearchService.java:340) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionListener.lambda$map$2(ActionListener.java:146) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:58) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.action.ActionRunnable$2.doRun(ActionRunnable.java:73) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:44) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:773) ~[elasticsearch-7.5.2.jar:7.5.2]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.5.2.jar:7.5.2]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
	at java.lang.Thread.run(Thread.java:830) ~[?:?]

Is there a workaround? Looks to be a java issue. I am using the java that comes with Elasticsearch when I do an apt-get install elasticsearch

   ├─4580 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Dj
   └─4728 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

Jan 23 12:46:26 es-cluster-node-1 systemd[1]: Starting Elasticsearch...
Jan 23 12:46:26 es-cluster-node-1 elasticsearch[4580]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.

Hey!

Have you already indexed data into Elasticsearch? If so, can you share the mapping of that?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.