@timestamp has always been applied automatically. Only time I've ever touched it is when I've adjusted the date to what the log message holds, rather than when the log message is processed by logstash.
So, I have no idea where it comes from, or how I could have turned it off on something. Is that in the template? --David Reagan On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko <ita...@code972.com> wrote: > Like the error suggests, "No mapping found for [@timestamp] in order to > sort on" > > Kibana expects a @timestamp field - make sure to push that in your source > > -- > > Itamar Syn-Hershko > http://code972.com | @synhershko <https://twitter.com/synhershko> > Freelance Developer & Consultant > Lucene.NET committer and PMC member > > On Tue, Mar 17, 2015 at 11:19 PM, David Reagan <jer...@gmail.com> wrote: > >> I keep getting an error like this: "Courier Fetch: 5 of 270 shards >> failed." in Kibana 4.0.1. >> >> After some Googling, I think it has something to do with @timestamp not >> existing for some of my data. But I'm not sure, because >> https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion >> was solved by not searching the kibana indexes. I'm only searching my >> logstash indexes. And I'm still getting that error. >> >> In kibana 4 I went to Settings->Indices and made sure I only have >> logstash-* listed under Index Patterns. >> >> I did recently update the template to what was in the logstash git HEAD. >> >> See http://pastebin.com/w7PmHxXS for my /var/log/elasticsearch/index.log >> output. As well as the template I'm using. It's at the bottom of the paste. >> >> I did check with curl -XGET ' >> http://localhost:9200/_cat/shards?pretty=true' to see if any shards had >> issues. They all had "STARTED" as their status. >> >> Any suggestions? >> >> -- >> You received this message because you are subscribed to the Google Groups >> "elasticsearch" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to elasticsearch+unsubscr...@googlegroups.com. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com >> <https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > elasticsearch+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com > <https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
