No mapping found for [relay_received_datetime] in order to sort on

[dswp (Dimitri)]

Hello,

I have recently set up Graylog and started loading data to it. My messages have a field named “relay_received_datetime” which is recognized as a “date”.

When I try to sort based on this field, I get an error:

curl -s -u foo:bar -H ‘Accept: application/json’ -H ‘X-Requested-By: cli’ -X GET ‘http://127.0.0.1:9000/api/search/universal/relative?query=message%3Amy_message%20AND%20my_identifier%3Abc&range=86400&fields=field1%2Crssi%2Crelay_received_datetime&sort=relay_received_datetime:desc’

{
“type”: “DetailedError”,
“message”: “Unable to perform search query\n\nNo mapping found for [power_in_volts] in order to sort onNo mapping found for [relay_received_datetime] in order to sort on”,
“details”: [
“No mapping found for [relay_received_datetime] in order to sort on”,
“No mapping found for [relay_received_datetime] in order to sort on”
]
}

Thank you in advance

[jan (Jan Doberstein)]

I guess that field is not in all indices a date.

[dswp (Dimitri)]

I went ahead and did: curl -XDELETE 'http://localhost:9200/*', then sent one message and checked that the type in graylog was appearing as “date”. Yet, the problem persisted.

Mind you, this works in kibana:

GET /graylog_0/_search
{
“sort” : [
{ “relay_received_datetime” : {“order” : “asc”}}
]
}

[dswp (Dimitri)]

Also note that I have also tried with other fields (eg. “integer” fields), with the same error, so I do not think this is a type issue, but some sort of indexing problem.

[dswp (Dimitri)]

It turns out that appending “&filter=streams:000000000000000000000001” to the query fixes this issue.

I wonder if it’s importance is mentioned somewhere in the documentation.

Even when sorting on the web interface, you can get the “No mapping found for …” exception when trying to sort.