I'm only searching the logstash-* indexes. So, all docs are generated by Logstash.
Unless Kibana 4 is searching my few non-logstash indexes even when I told it not too... Is that possible? How could I check? How does Logstash generate @timestamp? Does it have anything to do with the template I changed? --David Reagan On Tue, Mar 17, 2015 at 3:53 PM, Itamar Syn-Hershko <ita...@code972.com> wrote: > @timestamp is generated automatically by logstash, any documents not added > by logstash will not have it > > -- > > Itamar Syn-Hershko > http://code972.com | @synhershko <https://twitter.com/synhershko> > Freelance Developer & Consultant > Lucene.NET committer and PMC member > > On Wed, Mar 18, 2015 at 12:51 AM, David Reagan <jer...@gmail.com> wrote: > >> @timestamp has always been applied automatically. Only time I've ever >> touched it is when I've adjusted the date to what the log message holds, >> rather than when the log message is processed by logstash. >> >> So, I have no idea where it comes from, or how I could have turned it off >> on something. >> >> Is that in the template? >> >> --David Reagan >> >> On Tue, Mar 17, 2015 at 2:24 PM, Itamar Syn-Hershko <ita...@code972.com> >> wrote: >> >>> Like the error suggests, "No mapping found for [@timestamp] in order to >>> sort on" >>> >>> Kibana expects a @timestamp field - make sure to push that in your source >>> >>> -- >>> >>> Itamar Syn-Hershko >>> http://code972.com | @synhershko <https://twitter.com/synhershko> >>> Freelance Developer & Consultant >>> Lucene.NET committer and PMC member >>> >>> On Tue, Mar 17, 2015 at 11:19 PM, David Reagan <jer...@gmail.com> wrote: >>> >>>> I keep getting an error like this: "Courier Fetch: 5 of 270 shards >>>> failed." in Kibana 4.0.1. >>>> >>>> After some Googling, I think it has something to do with @timestamp not >>>> existing for some of my data. But I'm not sure, because >>>> https://groups.google.com/d/topic/elasticsearch/L6AG3dZOGJ8/discussion >>>> was solved by not searching the kibana indexes. I'm only searching my >>>> logstash indexes. And I'm still getting that error. >>>> >>>> In kibana 4 I went to Settings->Indices and made sure I only have >>>> logstash-* listed under Index Patterns. >>>> >>>> I did recently update the template to what was in the logstash git HEAD. >>>> >>>> See http://pastebin.com/w7PmHxXS for my >>>> /var/log/elasticsearch/index.log output. As well as the template I'm using. >>>> It's at the bottom of the paste. >>>> >>>> I did check with curl -XGET ' >>>> http://localhost:9200/_cat/shards?pretty=true' to see if any shards >>>> had issues. They all had "STARTED" as their status. >>>> >>>> Any suggestions? >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "elasticsearch" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to elasticsearch+unsubscr...@googlegroups.com. >>>> To view this discussion on the web visit >>>> https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com >>>> <https://groups.google.com/d/msgid/elasticsearch/9d816fa6-62c4-4651-a1e3-30c4f9239f5a%40googlegroups.com?utm_medium=email&utm_source=footer> >>>> . >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> -- >>> You received this message because you are subscribed to a topic in the >>> Google Groups "elasticsearch" group. >>> To unsubscribe from this topic, visit >>> https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe. >>> To unsubscribe from this group and all its topics, send an email to >>> elasticsearch+unsubscr...@googlegroups.com. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com >>> <https://groups.google.com/d/msgid/elasticsearch/CAHTr4Zsf8HH4WFvF8geoDy4zNhWOX6Y6hEsaLv8E8xhc04F62A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>> . >>> >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "elasticsearch" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to elasticsearch+unsubscr...@googlegroups.com. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com >> <https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AdzgruuC8mb5W2fKrxYi58tyBwak%2B-3g8w2hbWJTyRThw%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> >> For more options, visit https://groups.google.com/d/optout. >> > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/elasticsearch/dH6zw6swHBg/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > elasticsearch+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com > <https://groups.google.com/d/msgid/elasticsearch/CAHTr4ZsPGBtn9cSLt6Dyz0M%2BEznMCFM0d0Chj1h4%3DwJFX3qTng%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CANo%2B_AcBx87ctUERpoNKuDE80VQMupp10GZXB83W9Vuee5AJFQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
