SearchParseException error after recovery in yesterday's logstash


(Stuart Cracraft) #1

Getting this new error on my Kibana screen. Anyone seen this kind of thing before? The Elasticsearch cluster is in green state. There are no unassigned shards and all is accounted for. If I X out this error on the Kibana display and refresh, it just comes back with the same SearchParseException for logstash-2016.10.06. I have not yet deleted that index as it is yesterday and the cluster was in a Yellow state until this morning from a recovery. It is now in green. I will just wait but wanted to get this report into the general wizard pool in case it's an "Oh yeah, that happened to me a long time ago... and it happens to be XYZ" kinda thing. Thanks / --Stuart

× Oops! SearchParseException[[logstash-2016.10.06][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30m"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"*"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1475731113550,"to":1475903913550}}}]}}}}}}}},"size":0}]]]


(Lee Drengenberg) #2

Hi Stuart,

I looked at open and closed issues in github but I didn't find anything exactly like your case.

What version of Kibana and Elasticsearch are you on?

Can you describe what happened to cause this to start happening? What was the "recovery" you mentioned?

It looks like you're on the Discover tab when you get this?

Thanks,
Lee


(system) #3