Upgrade issues unable to upgrade the mappings for the index, field name contains dot

Elastic Stack Elasticsearch
1

Hi All,

Getting below error while restoring snapshot of 1.7 ES data on 2.4 ES:

{"error":{"root_cause":[{"type":"snapshot_restore_exception","reason":"[my_backup:snapshot_20190213] cannot restore index [test_09] because it cannot be upgraded"}],"type":"snapshot_restore_exception","reason":"[my_backup:snapshot_20190213] cannot restore index [test_09] because it cannot be upgraded","caused_by":{"type":"illegal_state_exception","reason":"unable to upgrade the mappings for the index [test_09], reason: [Field name [dv.fullId] cannot contain '.']","caused_by":{"type":"mapper_parsing_exception","reason":"Field name [dv.fullId] cannot contain '.'"}}},"status":500}

Our plan is to upgrade ES version from 1.7 -> 2.4 -> 5

Can someone please help provide pointers on fixing this issue?

Do I need to reindex or below setting can work?

export ES_JAVA_OPTS="-Dmapper.allow_dots_in_name=true"

2

I'd try to reindex in a 6.6.1 cluster directly.

3

Hi Dadoonet,

Thanks for your response.

Do you mean we should setup 6.6.1 ES , restore snapshot & reindex? If yes, in that case how about restoring snapshot? I faced the error mentioned during snapshot restoration on 2.4 binaries. How can we reindex until data is restored.

4

No. Just reindex from remote.

5

Current version of ES is 1.7. So is it fine to directly jump on 6.6.1 and do reindex from remote?

6

At least I'd give it a try.

7

1.7 -> 6.x did not work.

Further, we discussed this internally and decided to remove the filter [dv.fullId] causing error. Is it fine to remove the filter? We are assuming filter is used to speed up the searches in ES. Please confirm.

Also in parallel we tried, 1.7 -> 5.x by removing the filter using reindex from remote and got the response as below:

{"took":153859411,"timed_out":false,"total":2844167,"updated":0,"created":2844167,"deleted":0,"batches":11389,"version_conflicts":
0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-
1.0,"throttled_until_millis":0,"failures":[]}

Shall I assume reindex from remote is successful?

Please update on both questions. Will be grateful.

P.S. I am newbie to ES and hence so many questions. Please bear with me

8

It looks like you reindexed 2844167 documents in the new cluster.

9

Ok. Shall I consider reindex from remote successful?

Also, calling API http://170.21.237.102:9200/_cat/indices shows:

yellow open build_v y4Al3flpRRy_vtHUVfzDhw 5 1 559511147 0 237.2gb 237.2gb

How do I interpret this? What 'yellow' mean? Please help me explain all the fields

10

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

image
image.jpg764×92 16.4 KB

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.

Try to add ?v at the end. That will show the headers. For more details, look at the documentation where fields are explained.

Your cluster is yellow because you probably have only one node running. So replicas are not allocated.

11

Thanks for response. Will take care henceforth.
What the below output indicates (specially 0 after 559511147) ?

< yellow open build_v y4Al3flpRRy_vtHUVfzDhw 5 1 559511147 0 237.2gb 237.2gb >

12

As you can see it's not formatted. Please fix it.
And please do what I wrote:

13

Ok. Thanks for confirmation.

One more query, when we restore 1.7 elasticsearch data on 5.6 does index size increases? As per my observation, we did reindex from remote (1.7 -> 5.6). After reindex completed we see number of documents same on both but store.size increased.

14

It may increase. We are not using fielddata anymore (memory) but doc values (disk) for example.

15

Do you mean in 1.7 if there are any field data that got converted into doc values?

16

I mean that if you have in your mapping a keyword data type, it's using doc_values where string data type was using fielddata. Check your mapping.

17

Thanks dadoonet for all the help in resolving my queries.

One more question is what is filter in elasticsearch? Is it intended for performance improvement?

18

A filter is more performant than a query as you don't have to score the documents which means that filter results can be cached.

19

So I can say its for performance enhancement. So application functionality wil not break if I remove the filter. Correct?

20

I'm not sure I understand. Could explain with a concrete example what do you mean?