Graylog2-server: No mapping found for [timestamp] in order to sort on

[abretin]

Hi,

I just installed GrayLog on my server. When I logged in to the web interface I have this error message:

Error Message: Unable to perform search query. No mapping found for [timestamp] in order to sort on Details: No mapping found for [timestamp] in order to sort on

I tried to use the API with a GET request:

{ "message": "Unable to perform search query.\n\nNo mapping found for [timestamp] in order to sort on", "details": [ "No mapping found for [timestamp] in order to sort on" ] }

My server is on Ubuntu 16.04
Graylog : Graylog v2.3.2+3df951e
MongoDB : v3.2.17
ElasticSearch : 2.4.6

Has anyone ever encountered this problem or has a solution?

Thanks

[joschi]

@msgbrr This message is news to me. 😉

Please attach the logs of your Graylog and Elasticsearch nodes, and the relevant parts of your Graylog configuration (everything starting with elasticsearch_).

[abretin]

I have just updated ElasticSearch, I don't have this error anymore but I now have the message' loading' continuously.

Here is my Graylog log

2017-11-20T17:50:57.899Z INFO  [MongoIndexSet] Did not find a deflector alias. Setting one up now.
2017-11-20T17:50:57.900Z ERROR [IndexRotationThread] Couldn't point deflector to a new index
org.graylog2.indexer.ElasticsearchException: Couldn't collect aliases for index pattern graylog_*

{"error":"Incorrect HTTP method for uri [/graylog_*/_aliases] and method [GET], allowed: [PUT]","status":405}
    at org.graylog2.indexer.cluster.jest.JestUtils.specificException(JestUtils.java:91) ~[graylog.jar:?]
    at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:58) ~[graylog.jar:?]
    at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:63) ~[graylog.jar:?]
    at org.graylog2.indexer.indices.Indices.getIndexNamesAndAliases(Indices.java:308) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.getNewestIndexNumber(MongoIndexSet.java:151) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.getNewestIndex(MongoIndexSet.java:146) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.setUp(MongoIndexSet.java:252) ~[graylog.jar:?]
    at org.graylog2.periodical.IndexRotationThread.checkAndRepair(IndexRotationThread.java:138) ~[graylog.jar:?]
    at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:76) ~[graylog.jar:?]
    at java.lang.Iterable.forEach(Iterable.java:75) [?:1.8.0_151]
    at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:73) [graylog.jar:?]
    at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
2017-11-20T17:51:07.899Z INFO  [MongoIndexSet] Did not find a deflector alias. Setting one up now.
2017-11-20T17:51:07.901Z ERROR [IndexRotationThread] Couldn't point deflector to a new index
org.graylog2.indexer.ElasticsearchException: Couldn't collect aliases for index pattern graylog_*

{"error":"Incorrect HTTP method for uri [/graylog_*/_aliases] and method [GET], allowed: [PUT]","status":405}
    at org.graylog2.indexer.cluster.jest.JestUtils.specificException(JestUtils.java:91) ~[graylog.jar:?]
    at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:58) ~[graylog.jar:?]
    at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:63) ~[graylog.jar:?]
    at org.graylog2.indexer.indices.Indices.getIndexNamesAndAliases(Indices.java:308) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.getNewestIndexNumber(MongoIndexSet.java:151) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.getNewestIndex(MongoIndexSet.java:146) ~[graylog.jar:?]
    at org.graylog2.indexer.MongoIndexSet.setUp(MongoIndexSet.java:252) ~[graylog.jar:?]
    at org.graylog2.periodical.IndexRotationThread.checkAndRepair(IndexRotationThread.java:138) ~[graylog.jar:?]
    at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:76) ~[graylog.jar:?]
    at java.lang.Iterable.forEach(Iterable.java:75) [?:1.8.0_151]
    at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:73) [graylog.jar:?]
    at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]

[joschi]

@msgbrr Please provide all the information I've asked for.

[abretin]

Ok,
My ElasticSearch log :

[2017-11-20T17:32:12,783][INFO ][o.e.d.DiscoveryModule    ] [YBnfCgh] using discovery type [zen]
[2017-11-20T17:32:13,516][INFO ][o.e.n.Node               ] initialized
[2017-11-20T17:32:13,516][INFO ][o.e.n.Node               ] [YBnfCgh] starting ...
[2017-11-20T17:32:13,664][INFO ][o.e.t.TransportService   ] [YBnfCgh] publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}
[2017-11-20T17:32:13,677][WARN ][o.e.b.BootstrapChecks    ] [YBnfCgh] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2017-11-20T17:32:16,732][INFO ][o.e.c.s.MasterService    ] [YBnfCgh] zen-disco-elected-as-master ([0] nodes joined), reason: new_master {YBnfCgh}{YBnfCghoRRK9-7AFsdF_Iw}{CV83kmJZRS-IpIgzaI6T9g}{127.0.0.1}{127.0.0.1:9300}
[2017-11-20T17:32:16,737][INFO ][o.e.c.s.ClusterApplierService] [YBnfCgh] new_master {YBnfCgh}{YBnfCghoRRK9-7AFsdF_Iw}{CV83kmJZRS-IpIgzaI6T9g}{127.0.0.1}{127.0.0.1:9300}, reason: apply cluster state (from master [master {YBnfCgh}{YBnfCghoRRK9-7AFsdF_Iw}{CV83kmJZRS-IpIgzaI6T9g}{127.0.0.1}{127.0.0.1:9300} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]])
[2017-11-20T17:32:16,756][INFO ][o.e.h.n.Netty4HttpServerTransport] [YBnfCgh] publish_address {127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200}
[2017-11-20T17:32:16,756][INFO ][o.e.n.Node               ] [YBnfCgh] started
[2017-11-20T17:32:16,763][INFO ][o.e.g.GatewayService     ] [YBnfCgh] recovered [0] indices into cluster_state

Et GrayLog configuration :

elasticsearch_hosts = http://127.0.0.1:9200
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
elasticsearch_analyzer = standard

[joschi]

@msgbrr Are you sure that you've been running Elasticsearch 2.4.6 and not Elasticsearch 6.x?

Because the string "Incorrect HTTP method for uri" doesn't occur anywhere in Elasticsearch 2.4.6 nor in Elasticsearch 5.6.x.

$ git clone https://github.com/elasticsearch/elasticsearch
$ cd elasticsearch
$ git checkout v2.4.6
Note: checking out 'v2.4.6'.
[...]
HEAD is now at 5376dca9f7... mget with an alias shouldn't ignore alias routing (#25697)
$ ag 'Incorrect HTTP method for uri'
$ echo $?
1
$ git checkout 5.6
Previous HEAD position was 5376dca9f7... mget with an alias shouldn't ignore alias routing (#25697)
Branch '5.6' set up to track remote branch '5.6' from 'origin'.
Switched to a new branch '5.6'
$ ag 'Incorrect HTTP'
$ git checkout 6.x
Branch '6.x' set up to track remote branch '6.x' from 'origin'.
Switched to a new branch '6.x'
$ ag 'Incorrect HTTP'
core/src/main/java/org/elasticsearch/rest/RestController.java
370:                "Incorrect HTTP method for uri [" + request.uri() + "] and method [" + request.method() + "], allowed: " + validMethodSet);

qa/smoke-test-http/src/test/java/org/elasticsearch/http/RestHttpResponseHeadersIT.java
77:                containsString("Incorrect HTTP method for uri [/_tasks] and method [DELETE], allowed: [GET]"));
100:                containsString("Incorrect HTTP method for uri [/testindex/_settings] and method [POST], allowed:"));

docs/reference/migration/migrate_6_0/rest.asciidoc
103:  "error" : "Incorrect HTTP method for uri [/my_index/_settings] and method [POST], allowed: [PUT, GET]",

[razvanphp]

Yes, it's because of ES version 6.0, maybe graylog can detect this upfront and trigger a proper fatal/warning instead?

[jalogisch]

we will write some sentences about elasticsearch upgrades and pitfalls into the documentation.

[joschi]

Closed via Graylog2/documentation#408