Parse Failure Failed to parse source

Elastic Stack Elasticsearch
1

When i try to search kibana i see errors in the log and i cant find a sulotion

this is the logs

[2015-10-22 08:58:01,352][DEBUG][action.search.type ] [****] [logstash-2015.09.13][0], node[mVSbQ_KdTL-X-tMUepTaRA], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@def2fe8] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [Failed to parse source [{"size":500,"sort":{"Message":"asc"},"query":{"filtered":{"query":{"query_string":{"query":"","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"EventDate":{"gte":1445503380523,"lte":1445504280523}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}}},"aggs":{"2":{"date_histogram":{"field":"EventDate","interval":"30s","pre_zone":"+03:00","pre_zone_adjust_large_interval":true,"min_doc_count":0,"extended_bounds":{"min":1445503380513,"max":1445504280513}}}},"fields":["","_source"],"script_fields":{},"fielddata_fields":["EventDate","@timestamp"]}]]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:735)
at org.elasticsearch.search.SearchService.createContext(SearchService.java:560)
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:532)
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:294)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [No mapping found for [Message] in order to sort on]
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:214)
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:140)
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:719)
... 9 more

2

Looks like you are trying to sort on a non-existant field

3

I am only running this

Capture.JPG1903×125 22.5 KB

4

Does the index you configured Kibana to point at still exist?
Have you changed the definition of the index since you created the Kibana dashboard (presumably you have some widgets below your clipped screenshot).

5

i Inherit the cluster
all was working ok still i add new logstash logs
all is setup as default as i know only changed heap size to 4GB

i dont understand how to check this error
Parse Failure [No mapping found for [Message] in order to sort on]
how can i check the mapping?

6

Using this API [1]

This will tell you what fields are defined in the mapping for a given index. There's clearly a discrepancy between what the Kibana dashboard has been set up to work with and the index that exists today.
The Kibana forum will be the right place to ask about how you can reconfigure the dashboard.

Cheers
Mark

[1] Get mapping API | Elasticsearch Guide [8.11] | Elastic

7

Thanks will check it with Kibana