Hi all, I had a few problems today with my Graylog2 installation (see previous thread), and now that indexing is working, I can't search for messages. Whatever search query I set, I have this error :
Oh no, something went wrong! (You caused a lib.APIException. API call failed GET http://@10.111.12.171:12900/search/universal/relative/histogram?interval=minute&query=*&range=300&range_type=relative&filter=* returned 500 Internal Server Error body: Failed to execute phase [query], all shards failed; shardFailures {[Dc0R99StSgOVfKNgW8Hs7Q][graylog2_3][2]: RemoteTransportException[[Golden Archer][inet[/10.111.20.13:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][2]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; }{[dRm-3IW9TH6bHtFDJWTASg][graylog2_3][1]: RemoteTransportException[[Albert][inet[/10.111.20.11:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][1]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; }{[e4LzjJXnQSOSFiGYBokGXQ][graylog2_3][0]: RemoteTransportException[[Baron Strucker][inet[/10.111.20.12:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][0]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; } org.elasticsearch.action.search.SearchPhaseExecutionException: Failed to execute phase [query], all shards failed; shardFailures {[Dc0R99StSgOVfKNgW8Hs7Q][graylog2_3][2]: RemoteTransportException[[Golden Archer][inet[/10.111.20.13:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][2]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; }{[dRm-3IW9TH6bHtFDJWTASg][graylog2_3][1]: RemoteTransportException[[Albert][inet[/10.111.20.11:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][1]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; }{[e4LzjJXnQSOSFiGYBokGXQ][graylog2_3][0]: RemoteTransportException[[Baron Strucker][inet[/10.111.20.12:9300]][search/phase/query]]; nested: SearchParseException[[graylog2_3][0]: query[ConstantScore(*:*)],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query":{"query_string":{"query":"*","allow_leading_wildcard":false}},"facets":{"histogram":{"date_histogram":{"field":"timestamp","interval":"minute"},"facet_filter":{"bool":{"must":{"range":{"timestamp":{"from":"2014-03-21 15:51:37.758","to":"2014-03-21 15:56:37.758","include_lower":true,"include_upper":true}}}}}}}}]]]; nested: ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]; } at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.onFirstPhaseResult(TransportSearchTypeAction.java:272) at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$3.onFailure(TransportSearchTypeAction.java:224) at org.elasticsearch.search.action.SearchServiceTransportAction$4.handleException(SearchServiceTransportAction.java:222) at org.elasticsearch.transport.netty.MessageChannelHandler.handleException(MessageChannelHandler.java:181) at org.elasticsearch.transport.netty.MessageChannelHandler.handlerResponseError(MessageChannelHandler.java:171) at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:123) at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:296) at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:268) at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:255) at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:318) at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) at org.elasticsearch.common.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) at org.elasticsearch.common.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:724) ) I think the problem could be the insertion of a "test" message via a RAW TCP Input (for testing purpose) and Graylog is trying to parse it. Could it be that ? How to know this message ID to delete it or something else ? Thank you :) -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
