Opensearch bulk post request getting 400 error with "No field mapping can be found for the field with name [*]"

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Hi, I’m performing an Open search bulk post request for adding a document id in the search cluster and getting a 400 status code as a response.

Here is the request:

{"index": {"_index": "push", "_id": "id1-HTTP"}}
{"query": {"bool": {"must": [{"bool": {"should": [{"terms": {"channel": [123795, 131359]}}, {"query_string": {"query": "channel:(81929 OR 122641) "}}, {"bool": {"must": [{"range": {"doc_date": {"lte": "now-30d"}}}, {"query_string": {"query": "((channel:(90063) AND copyright_holder_id:(1717 OR 8818)) OR (channel:(90063) AND ((-copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881))) OR (channel:(126215 OR 106339)) OR (channel:(90063) AND copyright_holder_id:(1586 OR 10489)) OR (channel:(90063)  AND copyright_holder_id:(11289 OR 9378))) "}}]}}, {"bool": {"must": [{"range": {"doc_date": {"lte": "now-30d"}}}, {"query_string": {"query": "channel:(90063) "}}]}}, {"bool": {"must": [{"range": {"doc_date": {"lte": "now-30d"}}}, {"query_string": {"query": "channel:(130019) "}}]}}, {"bool": {"must": [{"range": {"doc_date": {"lte": "now-30d"}}}, {"query_string": {"query": "channel:(90063)  AND ((-copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881)) AND audio_nature:(speech OR voiced OR naturalSound)"}}]}}, {"bool": {"must": [{"range": {"doc_date": {"lte": "now-30d"}}}, {"query_string": {"query": "((channel:(90063) AND copyright_holder_id:(1717 OR 8818)) OR (channel:(90063) AND ((-copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881 ))) OR (channel:(126215 OR 106339)) OR (channel:(90063) AND copyright_holder_id:(1586 OR 10489)) OR (channel:(90063) AND copyright_holder_id:(11289 OR 9378))) "}}]}}, {"query_string": {"query": "channel:(81929 OR 122641)"}}, {"query_string": {"query": "channel:(90063) AND copyright_holder_id:(11289 OR 9378)"}}, {"query_string": {"query": "channel:(90063)"}}, {"bool": {"must": [{"bool": {"should": [{"terms": {"channel": [98304, 98306]}}, {"query_string": {"query": "channel:(823 OR 140757)"}}, {"query_string": {"query": ""}}, {"query_string": {"query": "channel:(135379) AND ((*:* -copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881)) "}}, {"query_string": {"query": "channel:(688 OR 689)"}}, {"query_string": {"query": "channel:(539 OR 540)"}}, {"query_string": {"query": "213123"}}, {"query_string": {"query": "channel:(24217)"}}]}}, {"range": {"doc_date": {"gte": "now-30d/h", "lte": "now/d"}}}]}}]}}], "must_not": [{"terms": {"outcode": ["audMedia:APEC", "audMedia:GAEBK", "audMedia:PIOL", "audMedia:LGFOXTHM", "audMedia:RCQV6"]}}, {"bool": {"must": [{"range": {"doc_date": {"lt": "now-24h/h"}}}, {"term": {"destination": "RPAU"}}]}}, {"bool": {"must": [{"terms": {"channel": [90063, 135379, 249985]}}, {"bool": {"should": [{"bool": {"must_not": [{"terms": {"copyright_holder_id": [1586, 1717]}}]}}, {"bool": {"must": [{"bool": {"must_not": [{"exists": {"field": "copyright_holder_id"}}]}}, {"bool": {"must_not": [{"term": {"media_type": "T"}}]}}]}}]}}]}}]}}, "info": {"user_id": id1, "account_id": acct_id, "protocol": "HTTP", "login_name": "Pus64206893571087", "email": "testuse1@mail.com", "timestamp": "2023-06-23T12:51:31Z"}}

the response:

{
    "took": 11,
    "errors": true,
    "items": [
        {
            "index": {
                "_index": "items_notify",
                "_id": "id1-HTTP",
                "status": 400,
                "error": {
                    "type": "mapper_parsing_exception",
                    "reason": "failed to parse",
                    "caused_by": {
                        "type": "query_shard_exception",
                        "reason": "No field mapping can be found for the field with name [*]",
                        "index": "items_notify",
                        "index_uuid": "YSMQnBreQsWRkO9EUFcvAQ"
                    }
                }
            }
        }
    ]
}

Describe the issue:
When performing bulk requests get 400 error with “No field mapping can be found for the field with name [*]”
I think I’m getting the error because of (-copyright_holder_id:[* TO *]) and (*:* -copyright_holder_id:[* TO *]) and I tried alternate ways to do it but no luck and I’m newbie for OpenSearch and this query is coming from the system and I checked all the fields in the query are mapped in the index mapping as well.

Configuration:

Relevant Logs or Screenshots:

2

Hey @naveen1221

Ill be honest, its hard to read your bulk request.

3

Hello @naveen1221

Could you maybe post the endpoint you are sending the request to? Plus it would help us a little if you could post your request body using the code block like so for example (using the </> symbol at the top of the comment bar):

POST _bulk
{ "delete": { "_index": "movies", "_id": "tt2229499" } }
{ "index": { "_index": "movies", "_id": "tt1979320" } }
{ "title": "Rush", "year": 2013 }
{ "create": { "_index": "movies", "_id": "tt1392214" } }
{ "title": "Prisoners", "year": 2013 }
{ "update": { "_index": "movies", "_id": "tt0816711" } }
{ "doc" : { "title": "World War Z" } }

I think some part of your query got lost due to automatic formatting.

BR,
Andreas

4

Hi @Gsmitt thanks for the reply i updated the question so now i might helpful for analyzing it.

1 Like
5

Hi, @ AESthetix256 thanks for the reply I updated the question so now you can analyze the problem more.

6

Could you maybe try to explain what the request should do or how you came up with the query?

I just took a look at your request body and found the following snippet

{
	"query_string": {
		"query": ""
}

which I don’t really understand what this should achieve in your context. Did you write this by hand or was this part generated?

The one part of the query which results in your error message I think is

{
    "query_string": {
    "query": "channel:(135379) AND ((*:* -copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881)) "
}

just like you mentioned. Could you describe what the purpose of this request is?

BR,
Andreas :slight_smile:

7

it will insert the document with all the values into the search cluster if it’s not present if the same document id is present then it replaces it and

the explanation of

"query": "channel:(135379 OR 12455) AND ((*:* -copyright_holder_id:[* TO *]) OR copyright_holder_id:(2016 OR 2881)) "

channel id should be 135379 or 12455

1. The document should either meet the criteria:
 a.) It can have any value in any field (denoted by `*:*`) except for the `copyright_holder_id` field, which should not have any value (`-copyright_holder_id:[* TO *]`) OR
b.) The `copyright_holder_id` field should have a value that is either `2016` or `2881`.

and the total query is generated by another system I’m new to OpenSearch and how the syntax works how to query I’m new to those so I don’t know much about OpenSearch in reverse, if you guys ask me why you wrote it like that means I don’t have any answer to it.

More elaboration:

`*:*` - This syntax, `*:*`, is a wildcard query that matches any field and any value. It essentially means "match all documents."

`-copyright_holder_id:[* TO *]` - This is a negative range query. It specifies that the field `copyright_holder_id` should not have any value. The range query `[ * TO * ]` encompasses all possible values, so excluding this range means that the field should be empty.

So, combining these two parts with the `OR` operator, the overall condition is:

Retrieve documents that have the `channel` field value of `135379` or '12455' and either have any value in any field (excluding the `copyright_holder_id` field) or have the `copyright_holder_id` field with a value of `2016` or `2881`.

In other words, the query looks for documents that match the specified channel and either have no value in the `copyright_holder_id` field or have specific values in that field.
8

Hello @naveen1221

This is quite a though question for me. What API endpoint are you sending this request to (for example GET /movies/_search)? Plus could you maybe also explain what the following part of your query:

"info": {
		"user_id": id1,
		"account_id": acct_id,
		"protocol": "HTTP",
		"login_name": "Pus64206893571087",
		"email": "testuse1@mail.com",
		"timestamp": "2023-06-23T12:51:31Z"
	}

It sits at the root level of your JSON - is this the information to be inserted?

BR,
Andreas

9

url: https://mgt.opensearch_url/_bulk

and that info is the details of the doc id which will be inserted to the document id