无法在Elasticsearch上请求数据

Question

I am develloping graphs for connection logs of a website. Logs are parsed by logstash and served via elasticsearch.

I've develloped some graphs, nothing outstanding nor hard, but working.

Friday I started elasticsearch, and every script I wrote to get the data fail when I send the query.

My first thought was that I somehow modified the query, so I printed it and send it to elasticsearch (with plugin head). The query was fine and I have result.

I tried purging logs from logstash and elasticsearch, and restarting to feed them from known good data... Didn't fix anything.

Tried to see if the config has any error, used a backup of a working one, didn't work either.

As last hope, I tried to print PHP errors, and I do get an exception thrown from deep inside of elasticsearch:

Fatal error: Uncaught exception 'Guzzle\Http\Exception\ServerErrorResponseException' with message 'Server error response [status code] 500 [reason phrase] 

Internal Server Error [url] http://localhost:9200/empreinte_index/mobile/_search' in /home/empreinte/vendor/guzzle/guzzle/src/Guzzle/Http/Exception/BadResponseException.php:43 

Stack trace: 
#0 /home/empreinte/vendor/guzzle/guzzle/src/Guzzle/Http/Message/Request.php(145): Guzzle\Http\Exception\BadResponseException::factory(Object(Guzzle\Http\Message\EntityEnclosingRequest), Object(Guzzle\Http\Message\Response)) 

#1 [internal function]: Guzzle\Http\Message\Request::onRequestError(Object(Guzzle\Common\Event), 'request.error', Object(Symfony\Component\EventDispatcher\EventDispatcher)) 

#2 /home/empreinte/vendor/symfony/event-dispatcher/Symfony/Component/EventDispatcher/EventDispatcher.php(164): call_user_func(Array, Object(Guzzle\Common\Event), 'request.error', Object(Symfony\Component\EventDispatcher\EventDispatcher)) 

#3 /home/empreinte/vendor/symfony/event-dispatcher/Symfony in /home/empreinte/vendor/elasticsearch/elasticsearch/src/Elasticsearch/Connections/GuzzleConnection.php on line 238 

So this seems to comfort the idea that my codes are fine, but I can't find what did I done wrong, nor where to search.

Here is a minimal example of the script I use:

<?php
    echo "Days";
    require '/home/empreinte/vendor/autoload.php';
    $client = new Elasticsearch\Client();

    $Query['index'] = 'empreinte_index';
    $Query['type'] = 'web';

    echo ".";

    //Building the timeframe needed. For brevity, using hardcoded data.

    $timeframe = "{"from" : "1404165600", "to" : "1404252000" },{"from" : "1404252000", "to" : "1404338400" }";

    echo ".";

    $Query['body']='
    {
        "aggs" : 
        {
            "temps" : 
            {
                "range" : 
                {
                    "field" : "time",
                    "ranges" : ['.$timeframe.']
                },
                "aggs" : 
                { 
                    "new_users" : 
                    { 
                        "terms" : 
                        { 
                            "field" : "is_newuser" 
                        } 
                    }
                }
            }
        }   
    }';

    echo ".";

    $result = $client->search($Query);

    //Parse the data to get them in usable form for graphs

    echo "OK</br>";

?>

Which output "Days...", And the exception if PHP is set to display it.

(If requested, I'll post the config file and some logs).

How can I fix this? Where can I find a similar error from which I can find a fix? What does mean the error?

Answer 1

If you check the response it looks like a request problem: 'request.error'

When you construct the timeframe you use double quotes to construct the string but also within the string, this can be a problem as well.

I do not really think this is the problem, but try to loose the quotes around the longs representing time stamps.

Finally try to print the query and try the query in a tool like sense from elasticsearch or the head plugin or the kopf plugin.

Hope that helps