# Parse Failure Failed to parse source

**URL:** <https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760>\
**Category:** Elasticsearch\
**Created:** [October 22, 2015, 9:01am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760 "2015-10-22T09:01:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [October 22, 2015, 9:01am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/1 "2015-10-22T09:01:46Z")

</div>

When i try to search kibana i see errors in the log and i cant find a sulotion

this is the logs

[2015-10-22 08:58:01,352][DEBUG][action.search.type] [\*\*\*\*_] [logstash-2015.09.13][0], node[mVSbQ\_KdTL-X-tMUepTaRA], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@def2fe8] lastShard [true]  
org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [Failed to parse source [{"size":500,"sort":{"Message":"asc"},"query":{"filtered":{"query":{"query\_string":{"query":"","analyze\_wildcard":true}},"filter":{"bool":{"must":[{"range":{"EventDate":{"gte":1445503380523,"lte":1445504280523}}}],"must\_not":[]}}}},"highlight":{"pre\_tags":["@kibana-highlighted-field@"],"post\_tags":["@/kibana-highlighted-field@"],"fields":{"":{}}},"aggs":{"2":{"date\_histogram":{"field":"EventDate","interval":"30s","pre\_zone":"+03:00","pre\_zone\_adjust\_large\_interval":true,"min\_doc\_count":0,"extended\_bounds":{"min":1445503380513,"max":1445504280513}}}},"fields":["_","\_source"],"script\_fields":{},"fielddata\_fields":["EventDate","@timestamp"]}]]  
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:735)  
at org.elasticsearch.search.SearchService.createContext(SearchService.java:560)  
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:532)  
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:294)  
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)  
at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)  
at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
at java.lang.Thread.run(Thread.java:745)  
Caused by: org.elasticsearch.search.SearchParseException: [logstash-2015.09.13][0]: from[-1],size[500]: Parse Failure [No mapping found for [Message] in order to sort on]  
at org.elasticsearch.search.sort.SortParseElement.addSortField(SortParseElement.java:214)  
at org.elasticsearch.search.sort.SortParseElement.addCompoundSortField(SortParseElement.java:140)  
at org.elasticsearch.search.sort.SortParseElement.parse(SortParseElement.java:96)  
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:719)  
... 9 more

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 22, 2015, 9:07am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/2 "2015-10-22T09:07:46Z")

</div>

> [@Erik\_Parienty](#):
>
> Parse Failure [No mapping found for [Message] in order to sort on]

Looks like you are trying to sort on a non-existant field

---

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [October 22, 2015, 9:10am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/3 "2015-10-22T09:10:19Z")

</div>

I am only running this

 ![](https://us1.discourse-cdn.com/elastic/original/2X/9/96e0d70c9ce859848747650ee619f90baaca33c8.JPG)

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 22, 2015, 9:13am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/4 "2015-10-22T09:13:53Z")

</div>

Does the index you configured Kibana to point at still exist?  
Have you changed the definition of the index since you created the Kibana dashboard (presumably you have some widgets below your clipped screenshot).

---

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [October 22, 2015, 9:47am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/5 "2015-10-22T09:47:46Z")

</div>

i Inherit the cluster  
all was working ok still i add new logstash logs  
all is setup as default as i know only changed heap size to 4GB

i dont understand how to check this error  
Parse Failure [No mapping found for [Message] in order to sort on]  
how can i check the mapping?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 22, 2015, 9:52am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/6 "2015-10-22T09:52:38Z")

</div>

> [@Erik\_Parienty](#):
>
> how can i check the mapping?

Using this API [1]

This will tell you what fields are defined in the mapping for a given index. There's clearly a discrepancy between what the Kibana dashboard has been set up to work with and the index that exists today.  
The Kibana forum will be the right place to ask about how you can reconfigure the dashboard.

Cheers  
Mark

[1] [Get mapping API | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html)

---

<div class="post-metadata">

**Author:** ![Erik\_Parienty](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\
**Post date:** [October 22, 2015, 10:32am UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/7 "2015-10-22T10:32:05Z")

</div>

Thanks will check it with Kibana

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:43pm UTC](https://discuss.elastic.co/t/parse-failure-failed-to-parse-source/32760/8 "2017-07-05T23:43:20Z")

</div>


