Indice import issue

[amagnus]

On box 1 running elasticsearch 0.90.9 (plugin 0.90.9.1) I'm exporting indice logstash-2014.03.05:

curl -XPOST 'localhost:9200/logstash-2014.03.05/_export'

On box 2 running elasticsearch 0.90.12 (plugin 0.90.11.2) I'm importing the indice:

curl -XPOST 'localhost:9200/logstash-2014.03.05/_import'

The indice seems to have imported properly on box 2:

curl localhost:9200/_aliases?pretty

{
  "kibana-int" : {
    "aliases" : { }
  },
  "logstash-2014.03.05" : {
    "aliases" : { }
  }
}

But nothing is returned when doing _search on box 2:

curl localhost:9200/logstash-2014.03.05/_search?pretty

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

What is missing?

Thanks, Adrien

[jprante]

Is something in the logs? Can you switch to DEBUG level?

[amagnus]

Seeing this error on box 2:

[2014-03-10 13:44:54,351][DEBUG][action.search.type       ] [fluentd01] [logstash-2014.03.05][0], node[-ejpEfvLSemLB-7NyobmvQ], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@de2cb04] lastShard [true]
org.elasticsearch.search.SearchParseException: [logstash-2014.03.05][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"*"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1394480693867,"to":"now"}}}]}}}}}}}},"size":0}]]
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:590)
        at org.elasticsearch.search.SearchService.createContext(SearchService.java:493)
        at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:467)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:239)
        at org.elasticsearch.search.action.SearchServiceTransportAction.sendExecuteQuery(SearchServiceTransportAction.java:202)
        at org.elasticsearch.action.search.type.TransportSearchCountAction$AsyncAction.sendExecuteFirstPhase(TransportSearchCountAction.java:70)
        at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.performFirstPhase(TransportSearchTypeAction.java:216)
        at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.performFirstPhase(TransportSearchTypeAction.java:203)
        at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$2.run(TransportSearchTypeAction.java:186)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:744)
Caused by: org.elasticsearch.search.facet.FacetPhaseExecutionException: Facet [0]: (key) field [@timestamp] not found
        at org.elasticsearch.search.facet.datehistogram.DateHistogramFacetParser.parse(DateHistogramFacetParser.java:160)
        at org.elasticsearch.search.facet.FacetParseElement.parse(FacetParseElement.java:94)
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:578)
        ... 11 more

[amagnus]

It looks like the issue is that my indice does not contain any type on box 2. It should have a fluentd type.

curl localhost:9200/logstash-2014.03.05/_mapping?pretty

{
  "logstash-2014.03.05" : { }
}

[amagnus]

Fixed.

I was not importing the archive properly.

Works fine now after re-importing and specifying the path:

curl -XPOST 'localhost:9200/logstash-2014.03.05/_import?path=/usr/local/elasticsearch/logstash-2014.03.05.tar.gz'