# Shard is not working due to \_source field

**URL:** <https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806>\
**Category:** Kibana\
**Created:** [January 8, 2022, 4:18pm UTC](https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806 "2022-01-08T16:18:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Butovoboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/butovoboy/32/80033_2.png) [@Butovoboy](https://discuss.elastic.co/u/Butovoboy)\
**Post date:** [January 8, 2022, 4:18pm UTC](https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806/1 "2022-01-08T16:18:17Z")

</div>

Hello, guys!  
I have a server with running ELK and other four servers with running filebeat on them. All these four filebeats send information directly to Elasticsearch on the first server.

One shard is not working and I get an error in Kibana:

 ![Снимок экрана 2022-01-08 в 19.07.54](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b95a895786c4077c7d4bad6fa7dfd4bcd5ffdf8d.png)

My setup.template is similar in every filebeat.yml:

```auto
setup.template:
  name: "filebeat"
  pattern: "filebeat-*"
  settings:
    index.number_of_shards: 1
    index.number_of_replicas: 0
    index.codec: best_compression
    _source.enabled: true

```

So, \_source is enabled everywhere, but It thinks that \_source is not enabled. So, how to enable the \_source field and to run this shard?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 10, 2022, 1:57am UTC](https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806/2 "2022-01-10T01:57:04Z")

</div>

(We aren't all guys 🙂)

It's odd that it'd complain about a single shard, as mappings are consistent against all shards. Is there anything in the Elasticsearch logs at that time?

---

<div class="post-metadata">

**Author:** ![Butovoboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/butovoboy/32/80033_2.png) [@Butovoboy](https://discuss.elastic.co/u/Butovoboy)\
**Post date:** [January 10, 2022, 7:36am UTC](https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806/3 "2022-01-10T07:36:17Z")

</div>

Thanks a lot for your reply!  
Sorry for "guys", didn't want to hurt somebody 😅

Yea, here are some errors in the elastic logs:

```auto
{"type": "server", "timestamp": "2022-01-10T07:03:53,413Z", "level": "ERROR", "component": "o.e.x.i.IndexLifecycleRunner", "cluster.name": "es-docker-cluster", "node.name": "es01", "message": "policy [filebeat] for index [filebeat-7.15.2-2022.01.10] failed on step [{\"phase\":\"hot\",\"action\":\"rollover\",\"name\":\"check-rollover-ready\"}]. Moving to ERROR step", "cluster.uuid": "Bej_vV1xSHaIbsoUYLrKcQ", "node.id": "HykhdOWRT1ipHsdhTDGP6Q" , 
"stacktrace": ["java.lang.IllegalArgumentException: index.lifecycle.rollover_alias [filebeat-7.15.2] does not point to index [filebeat-7.15.2-2022.01.10]",
"at org.elasticsearch.xpack.core.ilm.WaitForRolloverReadyStep.evaluateCondition(WaitForRolloverReadyStep.java:126) [x-pack-core-7.15.2.jar:7.15.2]",
"at org.elasticsearch.xpack.ilm.IndexLifecycleRunner.runPeriodicStep(IndexLifecycleRunner.java:176) [x-pack-ilm-7.15.2.jar:7.15.2]",
"at org.elasticsearch.xpack.ilm.IndexLifecycleService.triggerPolicies(IndexLifecycleService.java:365) [x-pack-ilm-7.15.2.jar:7.15.2]",
"at org.elasticsearch.xpack.ilm.IndexLifecycleService.triggered(IndexLifecycleService.java:303) [x-pack-ilm-7.15.2.jar:7.15.2]",
"at org.elasticsearch.xpack.core.scheduler.SchedulerEngine.notifyListeners(SchedulerEngine.java:184) [x-pack-core-7.15.2.jar:7.15.2]",
"at org.elasticsearch.xpack.core.scheduler.SchedulerEngine$ActiveSchedule.run(SchedulerEngine.java:217) [x-pack-core-7.15.2.jar:7.15.2]",
"at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) [?:?]",
"at java.util.concurrent.FutureTask.run(FutureTask.java:264) [?:?]",
"at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]",
"at java.lang.Thread.run(Thread.java:833) [?:?]"] }

```

But it seems to me that this error has been occurred some time after the shard has broken.

This is my another problem because I wrote in all filebeat.yml:

```auto
setup.ilm.enabled: false
ilm.enabled: false

```

But ilm is still running and I can't disable it throught GUI.

I didn't think that these two problems are connected to each other. So, no more errors do exist in Elasticsearch logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2022, 7:36am UTC](https://discuss.elastic.co/t/shard-is-not-working-due-to-source-field/293806/4 "2022-02-07T07:36:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.