X of Y shards failed in 7.12

Hello there,

after upgrade Elastic Stack from 7.10 to 7.12 a lot of dasboards, visualization and searches in discover shows the error message X of Y shards failed. In most cases, reason is that the specific field is not leaf field. These conflicted field had always been there, but always this error showed up only if I search this particular field. Now error shows up even if I simply want to view some documents, where is field present. I cannot find anything in release notes about this or something like that and it causes us a lot of trouble, especially when logging something like Response body, which often differs if I request multiple APIs. Is there any way to make Kibana less strict about mapping again? Custom mapping is probably not an option for us, we have 10K+ diferrent indices.

Hi @d4nnyx,

Looks like your are hitting: Discover: Rollup index pattern doesn't work with source fetching · Issue #92362 · elastic/kibana · GitHub
Rollup indices have issues in Discover then discover:searchFieldsFromSource advanced option is enabled.
Could you check if this is the case for you?

Hello @dosant ,

yes, we enabled this setting, because the new multi-field view is really confusing. We use dynamic mapping and every text field has its keyword type, so basically every field has another field which I dont want to care about. Is there any workaround for this issue?

I am not aware of a workaround :frowning:

Could you please contribute to the discussion Discover: Rollup index pattern doesn't work with source fetching · Issue #92362 · elastic/kibana · GitHub with your use case? That would be helpful.

Hello,

I just updated to 7.12.1 yesterday and now I'm seeing this in Discover, We have discover:searchFieldsFromSource enabled because we need to see the json structure, but We do not have rollup indices, this is an indice create by logstash.

Shoud I update this issue or create another one since I do not use rollup indices but I'm facing the same error reported on the issue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.