Graylog2 / Graylog2/graylog2-server
ES Query failed: The field you gave in the aggregation query existed as two different types in two different indices
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Urgh, this one is nasty. I have a field that I accidentally stored as a `Number` in the first index before storing as `String`. Since then a week has passed and the index cycled at least 3 times. Searches that should only hit the latest index ("Search in last 5 minutes") are failing with:
```
2017-03-11T12:06:58.176-06:00 DEBUG [search] [graylog-0e01437a-ab2d-474d-a61a-ad469ffe79df] failed to reduce search
org.elasticsearch.action.search.ReduceSearchPhaseException: [reduce]
at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction$2.onFailure(SearchQueryThenFetchAsyncAction.java:146) [graylog.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:39) [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_101]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_101]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_101]
Caused by: org.elasticsearch.search.aggregations.AggregationExecutionException: Merging/Reducing the aggregations failed when computing the aggregation [ Name: gl2_terms, Type: terms ] because: the field you gave in the aggregation query existed as two different types in two different indices
at org.elasticsearch.search.aggregations.bucket.terms.InternalTerms.doReduce(InternalTerms.java:185) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:153) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:170) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.InternalSingleBucketAggregation.doReduce(InternalSingleBucketAggregation.java:93) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:153) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:170) ~[graylog.jar:?]
at org.elasticsearch.search.controller.SearchPhaseController.merge(SearchPhaseController.java:411) ~[graylog.jar:?]
at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction$2.doRun(SearchQueryThenFetchAsyncAction.java:132) ~[graylog.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[graylog.jar:?]
... 3 more
2017-03-11T12:06:58.177-06:00 WARN [SearchResource] Unable to execute search: [reduce]
```
## Your Environment
* Graylog Version: 2.2.2
* Elasticsearch Version: 2.4.4
Contributor guide
Assessment
This issue has not been assessed yet.