Page MenuHomePhabricator

elk MediaWiki-Vagrant does not work: "Mapping definition for [tags] has unsupported parameters"
Closed, ResolvedPublic

Description

Logstash sends reasonable-looking POSTs to elasticsearch but they error out. Manually reproducing the request, I get this:

$  cat x.txt 
{"index":{"_index":"logstash-2016.12.08","_type":"mediawiki"}}
{"message":"IP: 10.0.2.2","@version":1,"@timestamp":"2016-12-08T08:51:33.964Z","type":"mediawiki","host":"mediawiki-vagrant","level":"DEBUG","tags":["syslog"],"channel":"wfDebug","url":"/w/index.php?title=VagrantRoleBuggy&buggy=php-exception","ip":"10.0.2.2","http_method":"GET","server":"dev.wiki.local.wmftest.net","referrer":"http://dev.wiki.local.wmftest.net:10000/wiki/VagrantRoleBuggy","uid":"f438aa0","process_id":6806,"wiki":"wiki","mwversion":"1.29.0-alpha","reqId":"d3199355da65d49f228f5c5c","private":false}

$ curl -XPOST --data-binary "@x.txt" '127.0.0.1:9200/_bulk?replication=async'
{"took":40,"errors":true,"items":[{"index":{"_index":"logstash-2016.12.08","_type":"mediawiki","_id":null,"status":400,"error":{"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_default_]: Mapping definition for [tags] has unsupported parameters:  [index_name : tag]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [tags] has unsupported parameters:  [index_name : tag]"}}}}]}

Event Timeline

Broken by rMWVA8371db5fb261: Upgrade to elastic 2.3.3 apparently since it upgraded Elasticsearch to 2.x where index_name and path have been removed.

Change 325909 had a related patch set uploaded (by Gergő Tisza):
Fix logstash => elasticsearch template for 2.x

https://gerrit.wikimedia.org/r/325909

The event list works after applying the patch, the graphs don't:

$ cat x2.txt 
{
  "facets": {
    "0": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "10s"
      },
      "global": true,
      "facet_filter": {
        "fquery": {
          "query": {
            "filtered": {
              "query": {
                "query_string": {
                  "query": "*"
                }
              },
              "filter": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "@timestamp": {
                          "from": 1481190511857,
                          "to": 1481191411857
                        }
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}

$ curl -XGET -d@x2.txt 'http://localhost:9200/logstash-2016.12.08/_search?pretty'
{
  "error" : {
    "root_cause" : [ {
      "type" : "search_parse_exception",
      "reason" : "failed to parse search source. unknown search element [facets]",
      "line" : 1,
      "col" : 14
    } ],
    "type" : "search_phase_execution_exception",
    "reason" : "all shards failed",
    "phase" : "query_fetch",
    "grouped" : true,
    "failed_shards" : [ {
      "shard" : 0,
      "index" : "logstash-2016.12.08",
      "node" : "GRtI539QTjKO_C3gB9sgJQ",
      "reason" : {
        "type" : "search_parse_exception",
        "reason" : "failed to parse search source. unknown search element [facets]",
        "line" : 1,
        "col" : 14
      }
    } ]
  },
  "status" : 400
}

The faceted search query is generated by Kibana. Apparently Kibana 3 is incompatible with Elasticsearch 2. What's the role of operations/software/kibana? It's still at 3.0 but production Kibana is 4.5.3 - has that repo been abandoned in favor of using upstream directly?

Change 325909 merged by jenkins-bot:
Fix logstash => elasticsearch template for 2.x

https://gerrit.wikimedia.org/r/325909