We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
We have a log server setup, with LogStash dumping into ES (1.3.2) and we are using Kibana (3.1).
If I type a query that isn't correct: +imap_op_duration_ms:[10000 to *]
note the "to" instead of "TO", kibana never gives me an error. I had to look in the network log to see what was going on.
When I look in the network log after hitting refresh, or changing the time, I see some 400 bad request results:
error: "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][4]: SearchParseException[[logstash-2014.09.24][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][2]: SearchParseException[[logstash-2014.09.24][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][3]: SearchParseException[[logstash-2014.09.24][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][0]: SearchParseException[[logstash-2014.09.24][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][1]: SearchParseException[[logstash-2014.09.24][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }]" status: 400
The text was updated successfully, but these errors were encountered:
This has been resolved in kibana 4. Kibana 4 sends the query to Elasticsearch's _validate endpoint first and attempts to validate syntax.
Sorry, something went wrong.
No branches or pull requests
We have a log server setup, with LogStash dumping into ES (1.3.2) and we are using Kibana (3.1).
If I type a query that isn't correct:
+imap_op_duration_ms:[10000 to *]
note the "to" instead of "TO", kibana never gives me an error. I had to look in the network log to see what was going on.
When I look in the network log after hitting refresh, or changing the time, I see some 400 bad request results:
error: "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][4]: SearchParseException[[logstash-2014.09.24][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][2]: SearchParseException[[logstash-2014.09.24][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][3]: SearchParseException[[logstash-2014.09.24][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][0]: SearchParseException[[logstash-2014.09.24][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }{[Md41IfY8R0GyFxEUwMAXPg][logstash-2014.09.24][1]: SearchParseException[[logstash-2014.09.24][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"executionContextId:"bdf9a442-6ee4-42d1-9d39-fac79cefbe45""}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237679,"to":1411590837679}}}]}}}}}}},"2":{"date_histogram":{"field":"@timestamp","interval":"30s"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to ]"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1411587237680,"to":1411590837680}}}]}}}}}}}},"size":0}]]]; nested: QueryParsingException[[logstash-2014.09.24] Failed to parse query [+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]]]; nested: ParseException[Cannot parse '+imapAccountId:"a98ffb35-e45b-4543-8b48-dae20532b101" +imap_op_duration_ms:[3000 to *]': Encountered " <RANGE_GOOP> " "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; nested: ParseException[Encountered " <RANGE_GOOP> "* "" at line 1, column 84.↵Was expecting one of:↵ "]" ...↵ "}" ...↵ ]; }]"
status: 400
The text was updated successfully, but these errors were encountered: