Parse Failure Failed to parse source


(Erik Parienty) #1

When i try to search kibana i see errors in the log and i cant find a sulotion

this is the logs

[2015-10-22 08:58:01,352][DEBUG][action.search.type ] [****] [logstash-2015.09.13][0], node[mVSbQ_KdTL-X-tMUepTaRA], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@def2fe8] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [Failed to parse source [{"size":500,"sort":{"Message":"asc"},"query":{"filtered":{"query":{"query_string":{"query":"
","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"EventDate":{"gte":1445503380523,"lte":1445504280523}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"
":{}}},"aggs":{"2":{"date_histogram":{"field":"EventDate","interval":"30s","pre_zone":"+03:00","pre_zone_adjust_large_interval":true,"min_doc_count":0,"extended_bounds":{"min":1445503380513,"max":1445504280513}}}},"fields":["
","_source"],"script_fields":{},"fielddata_fields":["EventDate","@timestamp"]}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:735)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:560)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:532)
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:294)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [No mapping found for [Message] in order to sort on]
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:214)
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:140)
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:719)
... 9 more


(Mark Harwood) #2

Looks like you are trying to sort on a non-existant field


(Erik Parienty) #3

I am only running this


(Mark Harwood) #4

Does the index you configured Kibana to point at still exist?
Have you changed the definition of the index since you created the Kibana dashboard (presumably you have some widgets below your clipped screenshot).


(Erik Parienty) #5

i Inherit the cluster
all was working ok still i add new logstash logs
all is setup as default as i know only changed heap size to 4GB

i dont understand how to check this error
Parse Failure [No mapping found for [Message] in order to sort on]
how can i check the mapping?


(Mark Harwood) #6

Using this API [1]

This will tell you what fields are defined in the mapping for a given index. There's clearly a discrepancy between what the Kibana dashboard has been set up to work with and the index that exists today.
The Kibana forum will be the right place to ask about how you can reconfigure the dashboard.

Cheers
Mark

[1] https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html


(Erik Parienty) #7

Thanks will check it with Kibana


(system) #8