Unable to fetch mapping. Do you have indices matching the pattern?

Question

I have been trying to fix the below issue but without any success (Logstash 2.1, Elasticsearch 2.1, Kibana 4.3.1)

This is my logstash.conf file

input {
  file {
    path => ["/var/log/network.log"]
    start_position => "beginning"
    type => "syslog"
    tags => [ "netsyslog" ]
  }
} #end input block
########################################
filter {
  if [type] == "syslog" {
    # Split the syslog part and Cisco tag out of the message
    grok {
      match => ["message", "%{CISCO_TAGGED_SYSLOG} %{GREEDYDATA:cisco_message}"]
    }
    # Parse the syslog severity and facility
    #syslog_pri { }

    # Parse the date from the "timestamp" field to the "@timestamp" field
    # 2015-05-01T00:00:00+02:00 is ISO8601
    grok {
      match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"]
    }

 date {
      #2015-05-01T00:00:00+03:00
      match => ["timestamp",
        "yyyy-MM-dd'T'HH:mm:ssZ"
#        "yyyy MM dd HH:mm:ss",
        ]
      #timezone => "Asia/Kuwait"
      }

    # Clean up redundant fields if parsing was successful
    if "_grokparsefailure" not in [tags] {
          mutate {
        rename => ["cisco_message", "message"]
        remove_field => ["timestamp"]
      }
    }

    # Extract fields from the each of the detailed message types
    grok {
      match => [
        "message", "%{CISCOFW106001}",
        "message", "%{CISCOFW106006_106007_106010}",
        "message", "%{CISCOFW106014}",
        "message", "%{CISCOFW106015}",
        "message", "%{CISCOFW106021}",
        "message", "%{CISCOFW106023}",
        "message", "%{CISCOFW106100}",
        "message", "%{CISCOFW110002}",
        "message", "%{CISCOFW302010}",
        "message", "%{CISCOFW302013_302014_302015_302016}",
        "message", "%{CISCOFW302020_302021}",
        "message", "%{CISCOFW305011}",
        "message", "%{CISCOFW313001_313004_313008}",
        "message", "%{CISCOFW313005}",
        "message", "%{CISCOFW402117}",
        "message", "%{CISCOFW402119}",
        "message", "%{CISCOFW419001}",
        "message", "%{CISCOFW419002}",
        "message", "%{CISCOFW500004}",
        "message", "%{CISCOFW602303_602304}",
        "message", "%{CISCOFW710001_710002_710003_710005_710006}",
        "message", "%{CISCOFW713172}",
        "message", "%{CISCOFW733100}"
      ]
    }
  }

  if [dst_ip] and [dst_ip] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
  geoip {
    source => "dst_ip"
    database => "/opt/logstash/vendor/GeoLiteCity.dat" ### Change me to location of GeoLiteCity.dat file
    target => "dst_geoip"
  }
  }

  if [src_ip] and [src_ip] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
  geoip {
    source => "src_ip"
    database => "/opt/logstash/vendor/GeoLiteCity.dat" ### Change me to location of GeoLiteCity.dat file
    target => "src_geoip"
  }
  }
  mutate {
    convert => [ "[src_geoip][coordinates]", "float" ]
  }  
}
########################################
output {
  stdout { codec => rubydebug }
  elasticsearch {

    hosts => "localhost"
    template => "/opt/logstash/elasticsearch-template.json"
    template_overwrite => true
  }
} #end output block

When I tail the logstash.conf file I can see it is parsing. However when I run curl 'localhost:9200/_cat/indices?v' I get that only .kibana is there Loading the Kibana interface says Unable to fetch mapping. Do you have indices matching the pattern?

Any help would be appreciated.

Thanks in advance.

If you don't have any indexes being created, check your logstash and elasticsearch logs. A mapping mismatch, for example, will drop documents. — Alain Collins
yes you are right. I am getting the below error in the entries. "type"=>"syslog", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default]: Mapping definition for [SourceGeo] has unsupported parameters: [path : full]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"Mapping definition for [SourceGeo] has unsupported parameters: [path : full]"}}}}, :level=>:warn} — Potta Pitot
Check your mapping/template for the definition of SourceGeo. — Alain Collins
@AlainCollins Thanks that fixed it. Can you add it as a response so that I can mark it as an answer. — Potta Pitot

Alain Collins Alain Collins · Accepted Answer · 2016-02-03T17:39:32

The initial debug recommendation is to check your logstash and elasticsearch logs. If you have a mapping conflict, elasticsearch will log about it and help you narrow it down.

Unable to fetch mapping. Do you have indices matching the pattern?

1 Answers