Pie chart not working

[shifty]

Hello everybody,

can someone explain me, what im doing wrong ? Because i dont get it I want to create a pie chart like you can see in the screenshots. But the pie chart doesnt appear

1.PNG

2.PNG

thanks for your help!

Shifty


//EDIT: This problem only pops up when i'm creating the pie chart on a "empty dashboard". When i use a server under "reports" the pie chart works correctly.

[ssax]

I'm able to replicate the issue but only if close an index that the dashboard is trying to search (or on an empty dashboard). I assume that it needs records to display otherwise it fails.

[shifty]

Hi ssax,

I'm not sure if I understand what you mean.
The empty dashboard is filled with running logs as shown in the screenshot, but the pie chart does not work

piechart.PNG

[ssax]

What version of Log Server are you running? You can find it on the bottom left hand side after logging into the web interface.

Please PM me a copy of your profile, you can download it from Admin > System Status by clicking the Download System Profile button.

[shifty]

Hi ssax,

my Version: Nagios Log Server 2.1.8
I've send you the System Profile.

Thanks
Shifty

[ssax]

I'm seeing this:

Code: Select all

Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
	at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
	at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
	at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
	at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
	at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
	at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
	at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
	at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
	... 8 more

This apparently says it's normal:

https://github.com/elastic/elasticsearc ... -163894259

But I don't get that on mine doing the same thing.

Please attach this file:

Code: Select all

/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.7.1-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json

[shifty]

Hi ssax,

thats really strange. Here is the elasticsearch-template.json

Code: Select all

{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "_all" : {"enabled" : true, "omit_norms" : true},
      "dynamic_templates" : [ {
        "message_field" : {
          "match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "string", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" }
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "string", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" },
            "fields" : {
              "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date" },
        "@version": { "type": "string", "index": "not_analyzed" },
        "geoip"  : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "float" },
            "longitude" : { "type" : "float" }
          }
        }
      }
    }
  }
}

[ssax]

Please send the full output of this:

Code: Select all

curl -k -L -v localhost:9200/logstash-2021.05.11/_mapping?pretty=1

[shifty]

here is the output

[ssax]

Please run this tail command as root and leave it running:

Code: Select all

tail -Fn0 /var/log/httpd/error_log /var/log/httpd/ssl_error_log /var/log/elasticsearch/*

Then replicate it in the web interface again and send the full output of the still running tail command.