Unable to connect to Elasticsearch. Error: [mapper_parsing_exception] No handler for type [flattened] declared on field [state]

o1o1o11o1 · January 16, 2020, 7:28pm

After upgrading Elasticsearch and Kibana from 7.1 to 7.5.1 Kibana is unable to start with the following error:

If I use OSS Kibana, then it starts.
Any ideas on what is going on?

wylie · January 16, 2020, 7:55pm

Yes, what is happening is that you are using OSS Elasticsearch with a non-OSS Kibana.

o1o1o11o1 · January 16, 2020, 8:30pm

Not true, I am using the Basic License Elasticsearch (upgrading from 7.1) and trying to use the basic license Kibana. I am upgrading them from the non oss debian repo.

ii  elasticsearch                    7.5.1                                      amd64        Distributed RESTful search engine built for the cloud

o1o1o11o1 · January 16, 2020, 8:35pm

curl -s -X GET --user XXX  "localhost:9200/_license?pretty"
{
  "license" : {
"status" : "active",
"uid" : "6213bfbe-1e89-4b0b-8967-cecb1889a075",
"type" : "basic",
"issue_date" : "2019-08-19T19:38:41.344Z",
"issue_date_in_millis" : 1566243521344,
"max_nodes" : 1000,
"issued_to" : "XXX",
"issuer" : "elasticsearch",
"start_date_in_millis" : -1
  }
}

o1o1o11o1 · January 16, 2020, 8:46pm

This seems to work with Kibana 7.5.0, but with some errors because Elasticsearch is 7.5.1

wylie · January 16, 2020, 10:08pm

It seems like there is something wrong with your configuration. I can't quite tell what it is, but what I know for sure is that the flattened mapping is available with the basic license in x-pack, and Kibana Lens (also basic license) uses that flattened type in its mapping. There was some discussion of your exact issue here, but the resolution is not exactly what you are looking for:
https://github.com/elastic/kibana/issues/52324

Shawn_McKee · February 6, 2020, 9:44pm

So I am having the same problem. Started from Kibana and Elasticsearch 7.2.0 and upgraded (via RPM) to 7.5.2. I have a basic license and get the same error:

> {"type":"log","@timestamp":"2020-02-06T21:13:58Z","tags":["info","migrations"],"pid":232731,"message":"Creating index .kibana_11."}
> {"type":"log","@timestamp":"2020-02-06T21:13:58Z","tags":["warning","migrations"],"pid":232731,"message":"Unable to connect to Elasticsearch. Error: [mapper_parsing_exception] No handler for type [flattened] declared on field [state]"}
> {"type":"log","@timestamp":"2020-02-06T21:13:58Z","tags":["fatal","root"],"pid":232731,"message":"{ Error: [mapper_parsing_exception] No handler for type [flattened] declared on field [state]\n    at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:349:15)\n    at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:306:7)\n    at HttpConnector.<anonymous> (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)\n    at IncomingMessage.wrapper (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4929:19)\n    at IncomingMessage.emit (events.js:194:15)\n    at endReadableNT (_stream_readable.js:1103:12)\n    at process._tickCallback (internal/process/next_tick.js:63:19)\n  status: 400,\n  displayName: 'BadRequest',\n  message:\n   '[mapper_parsing_exception] No handler for type [flattened] declared on field [state]',\n  path: '/.kibana_11',\n  query: {},\n  body:\n   { error:\n      { root_cause: [Array],\n        type: 'mapper_parsing_exception',\n        reason:\n         'Failed to parse mapping [_doc]: No handler for type [flattened] declared on field [state]',\n        caused_by: [Object] },\n     status: 400 },\n  statusCode: 400,\n  response:\n   '{\"error\":{\"root_cause\":[{\"type\":\"mapper_parsing_exception\",\"reason\":\"No handler for type [flattened] declared on field [state]\"}],\"type\":\"mapper_parsing_exception\",\"reason\":\"Failed to parse mapping [_doc]: No handler for type [flattened] declared on field [state]\",\"caused_by\":{\"type\":\"mapper_parsing_exception\",\"reason\":\"No handler for type [flattened] declared on field [state]\"}},\"status\":400}',\n  toString: [Function],\n  toJSON: [Function] }"}

I am running the non-OSS versions:

elasticsearch-7.5.2-1.x86_64
kibana-7.5.2-1.x86_64

Here is the Elasticsearch info:

 /usr/bin/curl  -H "Content-Type: application/json" -XGET "http://localhost:9200/"
{
  "name" : "atgrid",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "LN5csqKxTtK0S5zydp-nSQ",
  "version" : {
    "number" : "7.5.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "8bec50e1e0ad29dad5653712cf3bb580cd1afcdf",
    "build_date" : "2020-01-15T12:11:52.313576Z",
    "build_snapshot" : false,
    "lucene_version" : "8.3.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Here is the license info:

/usr/bin/curl  -H "Content-Type: application/json" -XGET "http://localhost:9200/_license?pretty"
{
  "license" : {
    "status" : "active",
    "uid" : "ef0a98f5-9f5c-4d2f-aa94-7cb46ab89a28",
    "type" : "basic",
    "issue_date" : "2019-04-20T18:26:41.702Z",
    "issue_date_in_millis" : 1555784801702,
    "max_nodes" : 1000,
    "issued_to" : "elasticsearch",
    "issuer" : "elasticsearch",
    "start_date_in_millis" : -1
  }
}

Is there some relevant x-pack configuration that is needed to activate "flattened" on the elasticsearch instance? Shouldn't it just be there?

wylie · February 6, 2020, 10:06pm

I've looked into the source code behind flattened field types in Elasticsearch, and there are a few things that are required:

Active X-pack license, which you appear to have
xpack.flattened.enabled: true, which is default

Can you verify that you have flattened enabled by making an info request to GET /_xpack?

https://www.elastic.co/guide/en/elasticsearch/reference/current/info-api.html

We're also looking into the possibility of an issue when upgrading, since the flattened type was introduced in 7.3

Julie_Tibshirani · February 6, 2020, 11:22pm

Thank you all for raising this issue, it's important that we get to the bottom it.

Adding to Wylie's questions, I wanted to double-check in what order you're upgrading Kibana and Elasticsearch? The proper order is always first to upgrade Elasticsearch, then Kibana. For example Kibana version 7.5 cannot talk to Elasticsearch 7.2.

Shawn_McKee · February 7, 2020, 2:20pm

Thanks for the quick reply. Here is the _xpack info:

 /usr/bin/curl  -H "Content-Type: application/json" -XGET "http://localhost:9200/_xpack?pretty"
{
  "build" : {
    "hash" : "8bec50e1e0ad29dad5653712cf3bb580cd1afcdf",
    "date" : "2020-01-15T12:11:52.334639Z"
  },
  "license" : {
    "uid" : "ef0a98f5-9f5c-4d2f-aa94-7cb46ab89a28",
    "type" : "basic",
    "mode" : "basic",
    "status" : "active"
  },
  "features" : {
    "analytics" : {
      "available" : true,
      "enabled" : true
    },
    "ccr" : {
      "available" : false,
      "enabled" : true
    },
    "enrich" : {
      "available" : true,
      "enabled" : true
    },
    "flattened" : {
      "available" : true,
      "enabled" : true
    },
    "frozen_indices" : {
      "available" : true,
      "enabled" : true
    },
    "graph" : {
      "available" : false,
      "enabled" : true
    },
    "ilm" : {
      "available" : true,
      "enabled" : true
    },
    "logstash" : {
      "available" : false,
      "enabled" : true
    },
    "ml" : {
      "available" : false,
      "enabled" : false,
      "native_code_info" : {
        "version" : "N/A",
        "build_hash" : "N/A"
      }
    },
    "monitoring" : {
      "available" : true,
      "enabled" : true
    },
    "rollup" : {
      "available" : true,
      "enabled" : true
    },
    "security" : {
      "available" : true,
      "enabled" : false
    },
    "slm" : {
      "available" : true,
      "enabled" : true
    },
    "spatial" : {
      "available" : true,
      "enabled" : true
    },
    "sql" : {
      "available" : true,
      "enabled" : true
    },
    "transform" : {
      "available" : true,
      "enabled" : true
    },
    "vectors" : {
      "available" : true,
      "enabled" : true
    },
    "voting_only" : {
      "available" : true,
      "enabled" : true
    },
    "watcher" : {
      "available" : false,
      "enabled" : true
    }
  },
  "tagline" : "You know, for X"
}

I ran a 'yum update' which updated: elasticsearch, logstash, filebeat, metricbeat and kibana. This was supposed to be a rolling upgrade, so I ran it on the main node (of 3 total nodes). The other two nodes run only Elasticsearch and are still on 7.2.0. The kibana instance should only be talking to the local elasticsearch instance. In kibana.yml I have:

server.host: "localhost"
elasticsearch.hosts: ["http://localhost:9200"]

Is it a problem that the other two elasticsearch instances are still 7.2.0 ? Thanks,

Shawn

wylie · February 7, 2020, 3:49pm

Is it a problem that the other two elasticsearch instances are still 7.2.0 ?

That sounds like a likely source of the problem. The flattened type was introduced in 7.3

Shawn_McKee · February 7, 2020, 4:05pm

OK, I will update the other two instances to 7.5.2 and we can see if this fixes it. I will post the result soon. Thanks,

Shawn

wylie · February 7, 2020, 4:17pm

You could potentially check the shards for .kibana indexes (there's multiple) to see if any are on the 7.2.0 nodes

Shawn_McKee · February 7, 2020, 4:18pm

Yes, after the upgrade Kibana is not hitting the issue. Sorry for the noise. Some shards for the .kibana indices were on the 7.2.0 systems and that was causing the problem. -Shawn

system · March 6, 2020, 4:18pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.