Elasticsearch-failed to parse search source. unknown search element [docvalue_fields]

1

Hi all,

Can anyone help me to resolve this error?

ERROR:failed to parse search source. unknown search element [docvalue_fields]

I am not able to display the JSON data into table,data is coming from the elasticsearch… it is displaying me the above error.

2

There is not enough information here to help you. What does the query look like? What does the raw query look like?

See this guide for examining the query:

1 Like
3

Hi, I have the same problem.

I want to visualize my nginx logs in a table of grafana, thats logs are in my elasticsearch server and the datasource its ok, I can create line graphics with this datasource but when I try to create a table this error occurs

 {
    "root_cause": [
        {
            "type": "search_parse_exception",
            "reason": "failed to parse search source. unknown search element [docvalue_fields]",
            "line": 1,
            "col": 295
        }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
        {
            "shard": 0,
            "index": "nginx-2018.01.22",
            "node": "YFkkW8JRSjqt9CyCJb_ajw",
            "reason": {
                "type": "search_parse_exception",
                "reason": "failed to parse search source. unknown search element [docvalue_fields]",
                "line": 1,
                "col": 295
            }
        }
    ]
}

That is my query inspector

{
“xhrStatus”: “complete”,
“request”: {
“method”: “POST”,
“url”: “api/datasources/proxy/2/_msearch”,
“data”: “{"search_type":"query_then_fetch","ignore_unavailable":true,"index":"nginx-"}\n{"size":500,"query":{"bool":{"filter":[{"range":{"@timestamp":{"gte":"1516429739561","lte":"1516531671023","format":"epoch_millis"}}},{"query_string":{"analyze_wildcard":true,"query":""}}]}},"sort":{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},"script_fields":{},"docvalue_fields":["@timestamp"]}\n”
},
“response”: {
“responses”: [
{
“error”: {
“root_cause”: [
{
“type”: “search_parse_exception”,
“reason”: “failed to parse search source. unknown search element [docvalue_fields]”,
“line”: 1,
“col”: 295
}
],
“type”: “search_phase_execution_exception”,
“reason”: “all shards failed”,
“phase”: “query”,
“grouped”: true,
“failed_shards”: [
{
“shard”: 0,
“index”: “nginx-2018.01.22”,
“node”: “YFkkW8JRSjqt9CyCJb_ajw”,
“reason”: {
“type”: “search_parse_exception”,
“reason”: “failed to parse search source. unknown search element [docvalue_fields]”,
“line”: 1,
“col”: 295
}
}
]
}
}
]
}
}

What I doing wrong?

4

Sorry, I solved that doing update of my Elastic Search service.