Shards failure error with unmapped data (string type)

[Charlotte_EGM (Charlotte Dupont)]

Hi,

Every time i open kibana dashboard, i have a shard failure error.

In the elasticsearch log, i can see this error for several fields :

org.elasticsearch.transport.RemoteTransportException: [cFJgxmD][192.168.111.213:9300][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [data.contact2.metadata.TimeInstant.value] in order to sort on

Apparently there is a mapping problem and it happens only with string data.
The dashboard itself is working correctly but there is this error popping all the time.
The visualisation with string data is only to display the last value based on timestamp.

I know there is a config to ignore unmapped value, but as I'm working with elasticsearch 5.3.3 it is ignoring it by default.

So how can I fix it ?

Thanks

[rashmi (kulkarni)]

Hi Charlotte,

Ignoring the mapping won't solve the issue because you cannot ignore an unknown mapping when it comes to sorting. Given that the field, data.contact2.metadata.TimeInstant.value, appears to be a timestamp field, there are two likely causes:

1. Your index pattern is using that field as the default timestamp field, but it does not actually exist in every index that matches the index pattern. This would give the appearance that your dashboards work, while spamming your Elasticsearch logs as those indices fail to respond to the overall request.
2. One (or more) of your visualizations is using that field, likely in a date histogram, and the some of your indices matching the overall index pattern do not contain that field.

Given the semi-metadata looking nature of the field, it seems likely that the field simply does not exist in all of the index pattern cases.