Tons of warning message "no index mapper found for field" in the log (one every seconds)


#1

After upgrading to Elasticsearch 2.1.1 from 1.5 version, the following warning message started to fill up elasticsearch log:

Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [api_version.raw] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [client_addr] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [client_addr.raw] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [forwarded_for] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [forwarded_for.raw] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [proto] returning default postings format
Feb  9 18:25:17 logstash elasticsearch[30011]: [2016-02-09 18:25:17,523][WARN ][index.codec              ] [Man-Beast] [logstash-2016.02.09] no index mapper found for field: [proto.raw] returning default postings format```

These warning messages are being pumped into the log almost every seconds and they are always on the same fields (`api_version`, `api_version.raw`, `client_addr`, `client_addr.raw`, `forwarded_for`, `forwarded_for.raw`, `proto`, and `proto.raw`).

I think these warning messages also affect the performance of the cluster as I noticed that the server is somewhat slower after the upgrade. 

Any suggestion on how to fix this issue would be greatly appreciated?

(Jörg Prante) #2

Did you follow the migration plugin advice?

It seems that you have incompatible fields in your old mapping.


#3

thank you for your help @jprante. I actually did follow the upgrade instruction and re-index my cluster so that all the fields that have the same name are of the same type. After that (and a few config changes), we were able to upgrade to 2.1.1 and our cluster was up for about a week or so before we started to see these warning messages.

Please note that the fields that the warning message are complaining about are not the one that the migration plugin identify to be re-indexed. In fact, we don't even have any field in our document with the .raw string in the name. I'm guessing that this is something that was being added by logstash.


(system) #4