Illegal_argument_exception on a single shard

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 2.19.2

Describe the issue:

Hello,

We are experiencing problems on a single shard.

If we search for the entire day of the 15th, we get the error shown in the screenshot, but if we search for the 15th and 16th, we get all the logs, including those from the 15th.

I checked the status of the shard with

GET _cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state

GET _cat/recovery?v&active_only=true

GET /iapp0-prod-p-2025.10.15-001566/_search_shards

GET _cluster/health/iapp0-prod-p-2025.10.15-001566?level=shards&pretty

GET _cluster/allocation/explain

{

“index”: “iapp0-prod-p-2025.10.15-001566”,

“shard”: 3,

“primary”: true

}

But we don’t find any errors.

Our next step is to correct the pipeline that extracts ts_insertion so that it only creates the field if it manages to extract it, avoiding possible conflicts.

The ts_insertion field also has conflicts on other shards, but in that case we do not encounter any problems.

Do you have any advice? Do you need any specific configuration?

Configuration:

Relevant Logs or Screenshots:

immagine
immagine751Ă—966 42.2 KB

2

Hey @apinna ,

Do you have any sample logs from the 15th with both types included for the conflicting log? Are each days in different indices? Or all in the 15th?

When searching for both days, can you show a sample of this?

Leeroy.

1 Like
3

We have reallocated the incriminated index and the problem seems to have resolved itself. If it happens again, we will send test logs.

1 Like