Graylog2 / Graylog2/graylog2-server

ES Query failed: The field you gave in the aggregation query existed as two different types in two different indices

Open
#3,603 7 comments 0 reactions 0 assignees View on GitHub
bug search triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Urgh, this one is nasty. I have a field that I accidentally stored as a `Number` in the first index before storing as `String`. Since then a week has passed and the index cycled at least 3 times. Searches that should only hit the latest index ("Search in last 5 minutes") are failing with:

```
2017-03-11T12:06:58.176-06:00 DEBUG [search] [graylog-0e01437a-ab2d-474d-a61a-ad469ffe79df] failed to reduce search
org.elasticsearch.action.search.ReduceSearchPhaseException: [reduce]
at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction$2.onFailure(SearchQueryThenFetchAsyncAction.java:146) [graylog.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:39) [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_101]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_101]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_101]
Caused by: org.elasticsearch.search.aggregations.AggregationExecutionException: Merging/Reducing the aggregations failed when computing the aggregation [ Name: gl2_terms, Type: terms ] because: the field you gave in the aggregation query existed as two different types in two different indices
at org.elasticsearch.search.aggregations.bucket.terms.InternalTerms.doReduce(InternalTerms.java:185) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:153) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:170) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.InternalSingleBucketAggregation.doReduce(InternalSingleBucketAggregation.java:93) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:153) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:170) ~[graylog.jar:?]
at org.elasticsearch.search.controller.SearchPhaseController.merge(SearchPhaseController.java:411) ~[graylog.jar:?]
at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction$2.doRun(SearchQueryThenFetchAsyncAction.java:132) ~[graylog.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[graylog.jar:?]
... 3 more
2017-03-11T12:06:58.177-06:00 WARN [SearchResource] Unable to execute search: [reduce]
```

## Your Environment

* Graylog Version: 2.2.2
* Elasticsearch Version: 2.4.4

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.