Hi David, This is probably due to Kibana trying to load an empty index and therefor missing 5 shards (ES creates 5 shards for an index by default). I stumbled upon the same issue as Logstash created empty indices in Elasticsearch under certain circumstances.
Using the Marvel plugin <https://www.elastic.co/downloads/marvel> (free trial during developing) you can easily sort on empty indices. After deleting the empty index (use curl or Sense <https://chrome.google.com/webstore/detail/sense-beta/lhjgkmllcaadmopgmanpapmpjgmfcfig>) the error will be probably be gone in Kibana. Cheers, Rodger Op woensdag 18 maart 2015 19:38:47 UTC+1 schreef David Reagan: > > I'm only searching the logstash-* indexes. So, all docs are generated by > Logstash. > > Unless Kibana 4 is searching my few non-logstash indexes even when I told > it not too... Is that possible? How could I check? > > How does Logstash generate @timestamp? Does it have anything to do with > the template I changed? > > --David Reagan > > On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko <[email protected] > <javascript:>> wrote: > >> @timestamp is generated automatically by logstash, any documents not >> added by logstash will not have it >> >> -- >> >> Itamar Syn-Hershko >> http://code972.com | @synhershko <https://twitter.com/synhershko> >> Freelance Developer & Consultant >> Lucene.NET committer and PMC member >> >> On Wed, Mar 18, 2015 at 12:51 AM, David Reagan <[email protected] >> <javascript:>> wrote: >> >>> @timestamp has always been applied automatically. Only time I've ever >>> touched it is when I've adjusted the date to what the log message holds, >>> rather than when the log message is processed by logstash. >>> >>> So, I have no idea where it comes from, or how I could have turned it >>> off on something. >>> >>> Is that in the template? >>> >>> --David Reagan >>> >>> On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko <[email protected] >>> <javascript:>> wrote: >>> >>>> Like the error suggests, "No mapping found for [@timestamp] in order >>>> to sort on" >>>> >>>> Kibana expects a @timestamp field - make sure to push that in your >>>> source >>>> >>>> -- >>>> >>>> Itamar Syn-Hershko >>>> http://code972.com | @synhershko <https://twitter.com/synhershko> >>>> Freelance Developer & Consultant >>>> Lucene.NET committer and PMC member >>>> >>>> On Tue, Mar 17, 2015 at 11:19 PM, David Reagan <[email protected] >>>> <javascript:>> wrote: >>>> >>>>> I keep getting an error like this: "Courier Fetch: 5 of 270 shards >>>>> failed." in Kibana 4.0.1. >>>>> >>>>> After some Googling, I think it has something to do with @timestamp >>>>> not existing for some of my data. But I'm not sure, because >>>>> https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion >>>>> was solved by not searching the kibana indexes. I'm only searching my >>>>> logstash indexes. And I'm still getting that error. >>>>> >>>>> In kibana 4 I went to Settings->Indices and made sure I only have >>>>> logstash-* listed under Index Patterns. >>>>> >>>>> I did recently update the template to what was in the logstash git >>>>> HEAD. >>>>> >>>>> See http://pastebin.com/w7PmHxXS for my >>>>> /var/log/elasticsearch/index.log output. As well as the template I'm >>>>> using. >>>>> It's at the bottom of the paste. >>>>> >>>>> I did check with curl -XGET ' >>>>> http://localhost:9200/_cat/shards?pretty=true' to see if any shards >>>>> had issues. They all had "STARTED" as their status. >>>>> >>>>> Any suggestions? >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "elasticsearch" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected] <javascript:>. >>>>> To view this discussion on the web visit >>>>> https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com >>>>> >>>>> <https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> For more options, visit https://groups.google.com/d/optout. >>>>> >>>> >>>> -- >>>> You received this message because you are subscribed to a topic in the >>>> Google Groups "elasticsearch" group. >>>> To unsubscribe from this topic, visit >>>> https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe >>>> . >>>> To unsubscribe from this group and all its topics, send an email to >>>> [email protected] <javascript:>. >>>> To view this discussion on the web visit >>>> https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com >>>> >>>> <https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>> . >>>> >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "elasticsearch" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected] <javascript:>. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com >>> >>> <https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer> >>> . >>> >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> -- >> You received this message because you are subscribed to a topic in the >> Google Groups "elasticsearch" group. >> To unsubscribe from this topic, visit >> https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe. >> To unsubscribe from this group and all its topics, send an email to >> [email protected] <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com >> >> <https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4c5d1245-1c70-43cc-a4a1-8a2df51390fb%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
