Kibana 显示 "Searching..."，没有显示任何结果。确认数据存在于 ElasticSearch 中
Kibana displays "Searching...", displays no results. Confirmed data exists in ElasticSearch
我正在尝试建立一个新索引，但我 运行 遇到了 Kibana 中的一些问题。发现页面现在已经显示 "Searching..." 几个小时了，只有少数几个数据点。我认为格式可能有问题？
indices页面显示Average、Maximum、Minimum都是数字，analyzed=false，indexed=true。
InstanceID、MetricName、Region 都是字符串，经过分析和索引 = True。
时间戳是一个日期
这些是否表明可能是什么问题？
编辑：
来自警告的附加信息："Doc values are not enabled on this field. This may lead to excess heap consumption when visualizing" ...和...
"This is an analyzed string field. Analyzed strings are highly unique and can use a lot of memory to analyze"
编辑 2：
一些注意事项：
我的映射似乎没有正常工作。
Invoke-RestMethod "$URI/mytestindex/t2credbal" -Method post -body '{
"mytestindex": {
"mappings": {
"t2credbal": {
"properties": {
"timestamp": {"type":"date"},
"minimum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
"maximum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
"average": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } }
} } } } }'
当我 运行 上述命令时，我的字段显示为 mytestindex.mappings.t2credbal.properties.timestamp，而不仅仅是时间戳
我的值报告为 Records.Timestamp（根据下面的命令），具有正确的字段类型，所以我不认为在我的情况下指定映射是完全必要的。然而，Kibana 无法搜索和分析数据，尽管它完全按照我的预期在 ElasticSearch 中列出。
$json= {Records: [
{
"Minimum": 280.91,
"Maximum": 280.97,
"Average": 280.94416666666672,
"Timestamp": "2015-04-27T13:12:00Z",
"InstanceID": "i-65e2b951",
"MetricName": "CPUCreditBalance",
"Region": "eu-west-1"
}
Invoke-RestMethod "$URI/mytestindex/t2credbal/" -Method Post -Body $json -ContentType 'application/json'
编辑#3
我将时间戳格式调整为适用于我的其他索引的格式；然而，我在尝试可视化时间戳字段时遇到以下错误：
Error: Request to Elasticsearch failed: {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[S73SynuOQzW4NKbwPN7tTg][mytestindex][0]: SearchParseException[[mytestindex][0]:
query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][1]: SearchParseException[[mytestindex][1]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][2]: SearchParseException[[mytestindex][2]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][3]: SearchParseException[[mytestindex][3]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][4]: SearchParseException[[mytestindex][4]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }]"}
at http://myurl.com/index.js?_b=5930:42978:38
at Function.Promise.try (http://myurl.com/index.js?_b=5930:46205:26)
at http://myurl.com/index.js?_b=5930:46183:27
at Array.map (native)
at Function.Promise.map (http://myurl.com/index.js?_b=5930:46182:30)
at callResponseHandlers (http://myurl.com/index.js?_b=5930:42950:22)
at http://myurl.com/index.js?_b=5930:43068:16
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at http://myurl.com/index.js?_b=5930:20959:26
编辑#4
修复了时间戳格式。
使用 _search 验证结果是否按预期显示？句法。
完全炸毁并重新创建我的索引，验证所有字段名称和类型是否正确。
发现屏幕现在显示 "no results" 而不是 "Searching..."。
当我将时间间隔从 15 分钟更改为任何其他值时，我得到以下信息：
Discover: Cannot read property 'indexOf' of undefined
TypeError: Cannot read property 'indexOf' of undefined
at Notifier.error (myurl/index.js?_b=5930:45607:23)
at Notifier.bound (myurl/index.js?_b=5930:32081:21)
at myurl/index.js?_b=5930:118772:18
at wrappedCallback (myurl/index.js?_b=5930:20873:81)
at myurl/index.js?_b=5930:20959:26
at Scope.$eval (myurl/index.js?_b=5930:22002:28)
at Scope.$digest (myurl/index.js?_b=5930:21814:31)
at Scope.$apply (myurl/index.js?_b=5930:22106:24)
at done (myurl/index.js?_b=5930:17641:45)
at completeRequest (myurl/index.js?_b=5930:17855:7)
我能够通过更正 ElasticSearch 中的日期格式来解决问题。我脚本中的 Powershell convertto-json 命令将时间戳对象转换为不与 Kibana 合作的日期格式。将日期格式设置为 yyyy-MM-hhThh:mm:ss 后，永无止境 "Searching..." 的问题消失了，但又出现了新问题。
将单独发布该问题。
我正在尝试建立一个新索引，但我 运行 遇到了 Kibana 中的一些问题。发现页面现在已经显示 "Searching..." 几个小时了，只有少数几个数据点。我认为格式可能有问题？
indices页面显示Average、Maximum、Minimum都是数字，analyzed=false，indexed=true。 InstanceID、MetricName、Region 都是字符串，经过分析和索引 = True。 时间戳是一个日期
这些是否表明可能是什么问题？
编辑： 来自警告的附加信息："Doc values are not enabled on this field. This may lead to excess heap consumption when visualizing" ...和... "This is an analyzed string field. Analyzed strings are highly unique and can use a lot of memory to analyze"
编辑 2： 一些注意事项： 我的映射似乎没有正常工作。
Invoke-RestMethod "$URI/mytestindex/t2credbal" -Method post -body '{
"mytestindex": {
"mappings": {
"t2credbal": {
"properties": {
"timestamp": {"type":"date"},
"minimum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
"maximum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
"average": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } }
} } } } }'
当我 运行 上述命令时，我的字段显示为 mytestindex.mappings.t2credbal.properties.timestamp，而不仅仅是时间戳
我的值报告为 Records.Timestamp（根据下面的命令），具有正确的字段类型，所以我不认为在我的情况下指定映射是完全必要的。然而，Kibana 无法搜索和分析数据，尽管它完全按照我的预期在 ElasticSearch 中列出。
$json= {Records: [
{
"Minimum": 280.91,
"Maximum": 280.97,
"Average": 280.94416666666672,
"Timestamp": "2015-04-27T13:12:00Z",
"InstanceID": "i-65e2b951",
"MetricName": "CPUCreditBalance",
"Region": "eu-west-1"
}
Invoke-RestMethod "$URI/mytestindex/t2credbal/" -Method Post -Body $json -ContentType 'application/json'
编辑#3
我将时间戳格式调整为适用于我的其他索引的格式；然而，我在尝试可视化时间戳字段时遇到以下错误：
Error: Request to Elasticsearch failed: {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[S73SynuOQzW4NKbwPN7tTg][mytestindex][0]: SearchParseException[[mytestindex][0]:
query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][1]: SearchParseException[[mytestindex][1]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][2]: SearchParseException[[mytestindex][2]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][3]: SearchParseException[[mytestindex][3]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][4]: SearchParseException[[mytestindex][4]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }]"}
at http://myurl.com/index.js?_b=5930:42978:38
at Function.Promise.try (http://myurl.com/index.js?_b=5930:46205:26)
at http://myurl.com/index.js?_b=5930:46183:27
at Array.map (native)
at Function.Promise.map (http://myurl.com/index.js?_b=5930:46182:30)
at callResponseHandlers (http://myurl.com/index.js?_b=5930:42950:22)
at http://myurl.com/index.js?_b=5930:43068:16
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at http://myurl.com/index.js?_b=5930:20959:26
编辑#4
修复了时间戳格式。 使用 _search 验证结果是否按预期显示？句法。 完全炸毁并重新创建我的索引，验证所有字段名称和类型是否正确。 发现屏幕现在显示 "no results" 而不是 "Searching..."。 当我将时间间隔从 15 分钟更改为任何其他值时，我得到以下信息：
Discover: Cannot read property 'indexOf' of undefined
TypeError: Cannot read property 'indexOf' of undefined
at Notifier.error (myurl/index.js?_b=5930:45607:23)
at Notifier.bound (myurl/index.js?_b=5930:32081:21)
at myurl/index.js?_b=5930:118772:18
at wrappedCallback (myurl/index.js?_b=5930:20873:81)
at myurl/index.js?_b=5930:20959:26
at Scope.$eval (myurl/index.js?_b=5930:22002:28)
at Scope.$digest (myurl/index.js?_b=5930:21814:31)
at Scope.$apply (myurl/index.js?_b=5930:22106:24)
at done (myurl/index.js?_b=5930:17641:45)
at completeRequest (myurl/index.js?_b=5930:17855:7)
我能够通过更正 ElasticSearch 中的日期格式来解决问题。我脚本中的 Powershell convertto-json 命令将时间戳对象转换为不与 Kibana 合作的日期格式。将日期格式设置为 yyyy-MM-hhThh:mm:ss 后，永无止境 "Searching..." 的问题消失了，但又出现了新问题。
将单独发布该问题。