Hello guys! Elasticsearch super newbie here!
I found that querying on Kibana with __missing__ keyword on a field that can not exists (some documents have that field, others don't), make my shards fail (e.g.: only 10 on 73 shards successful). It reports to me this error for each shard which failed.
{
"index": "logstash-15a5dae8-d225-43b3-80ef-d5f8690d562c-2015.12.03",
"shard": 0,
"status": 400,
"reason": "RemoteTransportException[[jun27-prod-elasticsearch-data-flznpfcu][inet[/172.17.0.1:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-15a5dae8-d225-43b3-80ef-d5f8690d562c-2015.12.03][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"facets\":{\"0\":{\"date_histogram\":{\"field\":\"@timestamp\",\"interval\":\"30s\"},\"global\":true,\"facet_filter\":{\"fquery\":{\"query\":{\"filtered\":{\"query\":{\"query_string\":{\"query\":\"NOT __missing__:method\"}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"@timestamp\":{\"from\":1449155039942,\"to\":1449158639943}}}]}}}}}}}},\"size\":0}]]]; nested: FacetPhaseExecutionException[Facet [0]: (key) field [@timestamp] not found]; "
}
Do you know any solution about it? It is a normal behavior?
I've also found that using __missing__ on a field with is never missing, doesn't make shards fail.
Thank you for your help.