Hi all
Few days ago, I added a second node to my ELK test installation to get some redundancy. Shut everything down, changed ES (1.5.0) config, restarted and waited until green, started ES on the second node, changed replicate settings on all existing indexes and watched data being copied - everything just looked fine.
Checking today, I realized that none of my Kibana (3) dashboards worked, found out that all the .raw fields were missing. And discovered that the 3 indexes which were created since my change above did not have a default mapping set. Which of course explains the missing .raw fields.
Now: to the best of my knowledge I didn't change anything else than adding a seconds ES node into the cluster. The Logstash processor which moves data from Redis into ES still runs on one node exclusively, and it uses localhost address to send data to ES.
Is there any explanation why Logstash would not create the default mapping anymore (but still create the indices)? Or what could I have messed up without realizing that could cause this?
CU, Joe