Unable to load the data from ELK using Databricks about elasticsearch-hadoop

[jbaiera]

Hi there, thanks for your interest in ES-Hadoop!

The exception message here essentially provides the answer you're looking for:

Cannot find mapping for :logs- - one is required before using Spark SQL

You are trying to load a dataset into spark for an index that the client cannot confirm exists. Please create the index before trying to read it, or if it exists already, make sure that the user account used for authentication is allowed to access the data.

[Sasik11941103]

Hi Jbaiera, Thanks for response. The Index exists and all the privileges were given to particular user when we try to load the local index we are able to load the data but when we try to load the data from remote index which is :logs- we are unable to load data. Remote Index has two local indexes east and west regions then the logs present under local indexes

[jbaiera]

I'm a bit confused here, are you talking about using the index via cross cluster search?

[Sasik11941103]

Yes

[Sasik11941103]

I'm trying to load data from ELK cross cluster search with an index pattern but I'm unable to load data and getting the above error. Please help me with the changes I need to make while pulling the logs.

[jbaiera]

Unfortunately, after taking a look through ES-Hadoop, we do not currently support reading from remote indices via cross cluster search. This is because ES-Hadoop needs access to each index's mapping data in order to correctly deserialize it in Hadoop/Spark. Remote indices do not support the retrieval of their mappings, only basic search operations are provided.

One way we could handle this in ES-Hadoop would be to investigate using the field capabilities API to obtain the mapping data, but this would require changes to the library itself; It's not really a work around for the problem. Unfortunately, there's no workaround that I'm aware of other than connecting to the remote cluster via ES-Hadoop directly.

I'll file a new issue for CCS support and link it here, sorry for the inconvenience!

[Sasik11941103]

Thanks for your response. Could you please create the ticket and attach it here.

[jbaiera]

I have opened #2107 for this