No mapping found

Graylog Central (peer support)
1

When I trying to sort logs based on particular filed It gives me error

Error Message:
Unable to perform search query No mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort onNo mapping found for [request_time] in order to sort on
Details:
No mapping found for [request_time] in order to sort on
No mapping found for [request_time] in order to sort on

36%20PM
Screen Shot 2018-06-05 at 3.40.36 PM.png2514×612 92.3 KB

2

Which version of Elasticsearch are you using?
What’s in the logs of your Graylog and Elasticsearch nodes?
:arrow_right: http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

3

@jochen This happens when there are more messages say when my messages count is 82k sort works fine but when message count is 250k it fails.

graylog log

18-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<6887da98-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<688801a0-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<688801a1-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<6887da99-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<688801a2-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z WARN  [Messages] Failed to index message: index=<graylog_159> id=<68873e5b-6f0a-11e8-9c51-02ef44fd458c> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_code]","caused_by":{"type":"number_format_exception","reason":"For input string: \"\"Mozilla/5.0\""}}>
2018-06-13T13:05:13.809Z ERROR [Messages] Failed to index [284] messages. Please check the index error log in your web interface for the reason. Error: One or more of the items in the Bulk request failed, check BulkResult.getItems() for more information.

elasticsearch log

    }
  ],
  "ext" : { }
}}] lastShard [true]
org.elasticsearch.transport.RemoteTransportException: [auJBup9][10.0.1.202:9300][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [request_time] in order to sort on
        at org.elasticsearch.search.sort.FieldSortBuilder.build(FieldSortBuilder.java:262) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.search.sort.SortBuilder.buildSort(SortBuilder.java:156) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:709) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.search.SearchService.createContext(SearchService.java:553) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:529) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:264) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:300) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:297) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.transport.TransportService$6.doRun(TransportService.java:577) [elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:527) [elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.1.2.jar:5.1.2]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]
4
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.