Kibana显示查询结果搜索错误

时间:2016-06-28 02:41:22

标签: exception elasticsearch kibana

我使用Kibana timelion插件进行一些查询并制作一些时间序列数据。 这是我的查询 .es(index='linux_cpu-*', metric='avg:CPU(%)', split='Hostname:5') 我没有发现此查询有任何问题,但却无法理解为什么它无法生成所需的结果。然后,当我与elasticsearch数据日志交叉检查时,我发现以下说明搜索解析错误。

[2016-06-26 23:32:43,290][DEBUG][action.search            ] [Bentley Wittman] [linux_cpu-2015.01.21][4], node[rtIRvgffRha3nFqYhjh8YA], [P], v[2], s[STARTED], a[id=xIKFCsvnRKaGqt7XyJtHNg]: Failed to execute [org.elasticsearch.action.search.SearchRequest@148c67f] lastShard [true]
RemoteTransportException[[Bentley Wittman][172.16.1.238:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":1420096382918,"lte":1422689282919,"format":"epoch_millis"}}}],"must_not":[],"filter":{}}},"aggs":{"q":{"meta":{"type":"split"},"filters":{"filters":{"*":{"query_string":{"query":"*"}}}},"aggs":{"Hostname":{"meta":{"type":"split"},"terms":{"field":"Hostname","size":5},"aggs":{"time_buckets":{"meta":{"type":"time_buckets"},"date_histogram":{"field":"@timestamp","interval":"1w","time_zone":"Asia/Shanghai","extended_bounds":{"min":1420096382918,"max":1422689282919},"min_doc_count":0},"aggs":{"avg(CPU(%))":{"avg":{"field":"CPU(%)"}}}}}}}}},"size":0}]]; nested: IllegalStateException[Field data loading is forbidden on [Hostname]];
Caused by: SearchParseException[failed to parse search source [{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":1420096382918,"lte":1422689282919,"format":"epoch_millis"}}}],"must_not":[],"filter":{}}},"aggs":{"q":{"meta":{"type":"split"},"filters":{"filters":{"*":{"query_string":{"query":"*"}}}},"aggs":{"Hostname":{"meta":{"type":"split"},"terms":{"field":"Hostname","size":5},"aggs":{"time_buckets":{"meta":{"type":"time_buckets"},"date_histogram":{"field":"@timestamp","interval":"1w","time_zone":"Asia/Shanghai","extended_bounds":{"min":1420096382918,"max":1422689282919},"min_doc_count":0},"aggs":{"avg(CPU(%))":{"avg":{"field":"CPU(%)"}}}}}}}}},"size":0}]]; nested: IllegalStateException[Field data loading is forbidden on [Hostname]];
    at org.elasticsearch.search.SearchService.parseSource(SearchService.java:855)
    at org.elasticsearch.search.SearchService.createContext(SearchService.java:654)
    at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:620)
    at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:371)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)
    at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33)
    at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)
    at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:376)
    at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.IllegalStateException: Field data loading is forbidden on [Hostname]
    at org.elasticsearch.index.fielddata.IndexFieldDataService$1.build(IndexFieldDataService.java:74)
    at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:275)
    at org.elasticsearch.search.aggregations.support.ValuesSourceParser.config(ValuesSourceParser.java:209)
    at org.elasticsearch.search.aggregations.bucket.terms.TermsParser.parse(TermsParser.java:76)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:198)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:176)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:103)
    at org.elasticsearch.search.aggregations.AggregationParseElement.parse(AggregationParseElement.java:60)
    at org.elasticsearch.search.SearchService.parseSource(SearchService.java:838)
    ... 12 more

有谁知道这意味着什么,我应该如何解决?

0 个答案:

没有答案