SearchParseException: no mapping found

Elastic Stack Elasticsearch
1

I have a script which indexes a document using the the following mapping:

{
    "mappings": {
        "rule-check-result": {
            "properties": {
                "date": {
                    "type": "date",
                    "format": "epoch_second"
                },
                "rule": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "alert": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "level": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "sms": {
                    "type": "string"
                },
                "subject": {
                    "type": "string"
                },
                "body": {
                    "type": "string"
                }
            }
        }
    }
}

As part of the indexing, the script runs this search:

{
    "from": 0,
    "size": 1,
    "query": {
        "filtered": {
            "query": {
                "match_all": {}
            },
            "filter": {
                "and": [
                    {
                        "term": {
                            "rule": "Replication"
                        }
                    },
                    {
                        "term": {
                            "alert": "Replication Lag"
                        }
                    }
                ]
            }
        }
    },
    "sort": {
        "date": {
            "order": "desc"
        }
    }
}

When I run the script I get the following in /var/log/elasticsearch/elasticsearch.log:

SearchParseException[No mapping found for [date] in order to sort on];
Caused by: SearchParseException[failed to parse search source [{
    "from": 0,
    "size": 1,
    "query": {
        "filtered": {
            "query": {
                "match_all": {}
            },
            "filter": {
                "and": [
                    {
                        "term": {
                            "rule": "Replication"
                        }
                    },
                    {
                        "term": {
                            "alert": "Replication Lag"
                        }
                    }
                ]
            }
        }
    },
    "sort": {
        "date": {
            "order": "desc"
        }
    }
}]];

Despite the exception the search actually does return a result.

I have two questions about this:

  1. Why is this exception generated even though the date field is clearly in the mapping?
  2. Why does the search return a result even though an exception is generated?
2

Hi,

is it possible that the search you running as part of the indexing hits more than one indes, either through wildcards or an alias? If any of this indices hasn't got the date field mapped you will get that exception. The search still returns hits from the index in which the date field is correctly mapped, the other indices that don't have that mapping will throw the error.

3

That was it. I narrowed the search to the particular index I'm using and it works fine now.

Thanks!