Visualization shard errors

Elastic Stack Kibana
#1

We originally had "Shard errors: X of Y shards failed- your data may not be complete"
We corrected our scripted field and now when we search data from the Discovery tab those errors are no longer present. (we had to tell Elastic to ignore the field if it was empty)
However when we use our Visualizations the errors populate again?

How do the dashboards/visualizations work on the back end? Why would we not receive those errors on the Discovery tab but the moment we go to a Dashboard they come back?

#2

Visualizations use aggregations under the hood, but they are using the same scripted fields.

owever in Discover only a limited number of documents is requested at once, so if there's a problem with your script which is occurring in rare cases, you might not run into it in Discover by chance. For Visualizations however in most cases all documents have to be visited, so all problems surface.

Can you copy/paste your scripted field here? Then I can check what the problem might be.

1 Like
#3

Thanks, we actually figured out it was an error with the mappings. The field they were trying to aggregate was set as a string rather than keyword. We ran the bootstrap and it created the correct mapping for all the new indices.

This does raise a follow up though that hopefully you can help.
All the old indices still have the wrong mapping and we need to go back and correct them.

The mappings before we ran the bootstrap were ~2k lines long.
After the bootstrap, the correct mappings show ~5k lines.

Ive seen the update API for index mappings but that only shows a few stanzas at a time. Whats the best way to handle an index mapping update when it has to deal with this many lines?

#4

It's probably best to ask this follow-up question in a new post in the Elasticsearch forum Elasticsearch - Discuss the Elastic Stack, as it's not related to Kibana as far as I understand.

#5

OK, thanks. I just created a new topic: " Index Mapping- Update API" if you have a moment to reply

#6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.