我使用Elasticsearch高级客户端6.1，当我尝试根据需要的值找到一些日志时，我得到了这个例外：
"reason":{"type":"exception","reason":"Elasticsearch exception [type=query_shard_exception, reason=No mapping found for [timeStamp] in order to sort on]","index_uuid":"EwqLKS3ZTDqlGdqfuHHi5w","index":".kibana"}}]},"hits":{"total":3,"max_score":null,"hits":[{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"Vh5zUGEBAUNy8RN4gRLf","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]},{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"Vx5zUGEBAUNy8RN4hRLJ","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]},{"_index":"portal-logs-01.02.2018","_type":"logs_info","_id":"VR5zUGEBAUNy8RN4fxIq","_score":null,"_source":{"timeStamp":"2018-01-31T15:30:41.000Z","header":"test Header 15","message":"test message 34","level":"TRACE","node":"first node","system":"super system 100000","port":9400,"module":"test module","submodule":"test submodule","thread":"test thread","operation":"some operation","sessionId":"1","userLogin":"user","userName":"user","office":"of 52","location":{"lat":41.12,"lon":-71.34},"ip":"192.168.3.93","device":"some device"},"sort":[1517412641000]}]}}
这是来自ES服务器的日志：
[2018-02-01T02:46:51,407][DEBUG][o.e.a.s.TransportSearchAction] [node-43] [portal-user-26.01.2018][3], node[SAPKQLGGSJiR8bMBdkNvfQ], [P], s[STARTED], a[id=9d6qWfW3SWaigflL9TCmmw]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[], indicesOptions=IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false], types=[], routing='null', preference='null', requestCache=null, scroll=null, maxConcurrentShardRequests=10, batchedReduceSize=512, preFilterShardSize=128, source={"from":0,"size":20,"query":{"bool":{"filter":[{"match_phrase":{"header":{"query":"test Header 15","slop":0,"boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"sort":[{"timeStamp":{"order":"desc"}}]}}]
org.elasticsearch.transport.RemoteTransportException: [node-70][192.168.3.70:9300][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.query.QueryShardException: No mapping found for [timeStamp] in order to sort on
at org.elasticsearch.search.sort.FieldSortBuilder.build(FieldSortBuilder.java:319) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.sort.SortBuilder.buildSort(SortBuilder.java:155) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:718) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService.createContext(SearchService.java:552) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:528) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:324) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:310) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:306) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.search.SearchService$3.doRun(SearchService.java:996) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:637) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) ~[elasticsearch-6.1.2.jar:6.1.2]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.1.2.jar:6.1.2]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_162]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_162]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_162]
我有这样的映射： PUT _template / portal-logs
{
"template": "portal-logs-*",
"settings": { "number_of_shards": 5 },
"mappings": {
"logs_info": {
"_all": {
"enabled": false
},
"properties": {
"device": {"type": "keyword"},
"header": {"type": "text"},
"ip": {"type": "keyword"},
"level": {"type": "text"},
"location": {"type": "geo_point"},
"message": {"type": "text"},
"module": {"type": "keyword"},
"node": {"type": "keyword"},
"office": {"type": "keyword"},
"operation": {"type": "keyword"},
"port": {"type": "integer"},
"sessionId": {"type": "keyword"},
"submodule": {"type": "keyword"},
"system": {"type": "keyword"},
"thread": {"type": "keyword"},
"timeStamp": {"type": "date"},
"userLogin": {"type": "keyword"},
"userName": {"type": "keyword"}
}
}
}
}
这是代码的一部分：
sourceBuilder.query(bqb)
.size(pageable.getPageSize()).from(pageable.getOffset())
.sort(new FieldSortBuilder("timeStamp").order(SortOrder.DESC));
答案 0 :(得分：1)
实际上，问题是您要查询所有索引，包括.kibana，其中没有任何timeStamp字段，如错误消息所示。
{
"index": ".kibana",
"index_uuid": "EwqLKS3ZTDqlGdqfuHHi5w",
"reason": "Elasticsearch exception [type=query_shard_exception, reason=No mapping found for [timeStamp] in order to sort on]",
"type": "exception"
}
你应该只对portal-log-*索引进行查询，这样就可以了。