{"action":"created","issue":{"url":"https://api.github.com/repos/elasticsearch/kibana/issues/2843","labels_url":"https://api.github.com/repos/elasticsearch/kibana/issues/2843/labels{/name}","comments_url":"https://api.github.com/repos/elasticsearch/kibana/issues/2843/comments","events_url":"https://api.github.com/repos/elasticsearch/kibana/issues/2843/events","html_url":"https://github.com/elasticsearch/kibana/issues/2843","id":56287419,"number":2843,"title":"Kibana won't load if a known date field from index pattern mapping isn't found.","user":{"login":"matt-david","id":6386615,"avatar_url":"https://avatars.githubusercontent.com/u/6386615?v=3","gravatar_id":"","url":"https://api.github.com/users/matt-david","html_url":"https://github.com/matt-david","followers_url":"https://api.github.com/users/matt-david/followers","following_url":"https://api.github.com/users/matt-david/following{/other_user}","gists_url":"https://api.github.com/users/matt-david/gists{/gist_id}","starred_url":"https://api.github.com/users/matt-david/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matt-david/subscriptions","organizations_url":"https://api.github.com/users/matt-david/orgs","repos_url":"https://api.github.com/users/matt-david/repos","events_url":"https://api.github.com/users/matt-david/events{/privacy}","received_events_url":"https://api.github.com/users/matt-david/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-02T20:18:34Z","updated_at":"2015-02-03T15:23:19Z","closed_at":"2015-02-03T15:23:19Z","body":"I don't know the exact issue. It could be because the timestamp field isn't found or because the object the timestamp field belongs to doesn't exist.\r\n\r\nAnyways, the current case I have is that we are creating daily indices. We end up with a field 'illegal_input.timestamp' that may or may not exist in an index. When the index rolls over, we can't load Kibana when the JS gets a 400 from the following request:\r\n\r\n    http://<host>/elasticsearch/<index>-2015.02.02/_search?ignore_unavailable=true&timeout=30000\r\n    {\r\n        ...\r\n        \"script_fields\": {\r\n            \"illegal_input.timestamp\": {\r\n                \"script\":\"if (doc[\\\"illegal_input.timestamp\\\"].value == 0) { null } else { doc[\\\"illegal_input.timestamp\\\"].value }\"\r\n            },\r\n            \"timestamp\":{\r\n                \"script\":\"if (doc[\\\"timestamp\\\"].value == 0) { null } else { doc[\\\"timestamp\\\"].value }\"\r\n            }\r\n        }\r\n    }\r\n\r\nAnd the ES logs have the following stacktrace:\r\n\r\n    Caused by: org.elasticsearch.script.groovy.GroovyScriptExecutionException: ElasticsearchIllegalArgumentException[No field found for [illegal_input.timestamp] in mapping with types []]\r\n            at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript.run(GroovyScriptEngineService.java:253)\r\n            at org.elasticsearch.search.fetch.script.ScriptFieldsFetchSubPhase.hitExecute(ScriptFieldsFetchSubPhase.java:74)\r\n            at org.elasticsearch.search.fetch.FetchPhase.execute(FetchPhase.java:211)\r\n            at org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:481)\r\n            at org.elasticsearch.search.action.SearchServiceTransportAction$FetchByIdTransportHandler.messageReceived(SearchServiceTransportAction.java:868)\r\n            at org.elasticsearch.search.action.SearchServiceTransportAction$FetchByIdTransportHandler.messageReceived(SearchServiceTransportAction.java:862)\r\n            at org.elasticsearch.transport.netty.MessageChannelHandler$RequestHandler.run(MessageChannelHandler.java:275)\r\n            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n            at java.lang.Thread.run(Thread.java:745)\r\n\r\nThe script is expecting an illegal_input object to have a timestamp field because it exists in the stored index pattern's mapping. I'd assume the applies to any other auto-detected timestamp fields as I can't backtrace the source of the post data. The Kibana 'script' should anticipate the field not existing in the index's mapping. Or if the individual index's mapping is available, check it before adding the script to the request body."},"comment":{"url":"https://api.github.com/repos/elasticsearch/kibana/issues/comments/72668917","html_url":"https://github.com/elasticsearch/kibana/issues/2843#issuecomment-72668917","issue_url":"https://api.github.com/repos/elasticsearch/kibana/issues/2843","id":72668917,"user":{"login":"rashidkpc","id":1250387,"avatar_url":"https://avatars.githubusercontent.com/u/1250387?v=3","gravatar_id":"","url":"https://api.github.com/users/rashidkpc","html_url":"https://github.com/rashidkpc","followers_url":"https://api.github.com/users/rashidkpc/followers","following_url":"https://api.github.com/users/rashidkpc/following{/other_user}","gists_url":"https://api.github.com/users/rashidkpc/gists{/gist_id}","starred_url":"https://api.github.com/users/rashidkpc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rashidkpc/subscriptions","organizations_url":"https://api.github.com/users/rashidkpc/orgs","repos_url":"https://api.github.com/users/rashidkpc/repos","events_url":"https://api.github.com/users/rashidkpc/events{/privacy}","received_events_url":"https://api.github.com/users/rashidkpc/received_events","type":"User","site_admin":false},"created_at":"2015-02-03T15:23:19Z","updated_at":"2015-02-03T15:23:19Z","body":"This is fixed in master https://github.com/elasticsearch/kibana/issues/2509"}}