Sorting on custom date field, error 500

Graylog Central (peer support)
1

Hello,

I have a problem with sorting on a custom date field i have created:

Error Message:

Unable to perform search query No mapping found for [test2] in order to sort onNo mapping found for [test2] in order to sort on

Details:

  • No mapping found for [test2] in order to sort on
  • No mapping found for [test2] in order to sort on

Search status code:

500

Search response:

cannot GET https:/myserver:12900/api/search/universal/relative?query=%2A&range=300&filter=streams%3A5a73566e1ab162ca37c9b298&limit=150&sort=test2%3Adesc (500)

I create the field using extractor and converter:

2018-09-19 18:00:27,878 CEST SOME log thingy

parsed to field “test2” as 2018-09-19 18:00:27,878 and converted using date converter with pattern: yyyy-MM-dd HH:mm:ss,SSS

I see the field type as time in Kibana, I can sort with this field in Kibana. When I try to sort in Graylog i get this error. Nothing shows up in server logs after that

Graylog 2.4.6+ceaa7e4

2

Solved:

The main problem were old indexes with wrong ranges. Recalculating did the job. Another thingy may be mapping, can be checked via curl -X GET ‘http://elastic1:9200/graylog_deflector/_mapping?pretty’ and so on

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.