scene :
The zipkin link log normally generates link data in elasticsearch. When the data is queried through es, the traceId data exists, but the data before the current day's data cannot be queried by calling the zipkin api.
The data of the day exists in es
The data before the day also exists in es
The above shows that it is normal for zipkin to write data in es normally.
Question 1: Why can’t I call the zipkin interface to query the data before the day as follows
Where gisq_request_id=fe88132e-1190-4e36-b0b2-286bceb39df1 is the id before that day.
Note: The lookback parameter is the parameter carried by the api in zipkin. The default query is the current data lookback. The default is 86400000. If you want to query the previous data, you need 86400000*nday. Here I query the data of the previous 10 days
Where gisq_request_id=973fa4e7-91e2-4d30-82dd-ad6770144897 is the id of the day.
This is very strange, the data exists in elasticsearch, why can't it be queried by calling zipkin's api? ? ? ? ?
problem analysis:
Index information of api call exception in zipkin
API call normal index information in zipkin
Data Generation Structural Analysis
Under abnormal circumstances, the structure generated by the data contains the _q field, because this field is not excluded in the mapping template mapping
Under normal data clearing, there is no _q field under _source, because this field is excluded in the mapping template mapping.
In addition, when zipkin/api/v2/traces?annotationQuery=gisq_request_id=fe88132e-1190-4e36-b0b2-286bceb39df1&lookback=864000000&limit=100 is called abnormally, the backend reports a null pointer.
The prompt is that json parsing failed
problem causes:
The zipkin index template may have been moved by others,
It may be to delete the index template through the es command
It may also be that the current zipkin index is deleted through the graphical interface, and the index data recreated in the code
Scene reproduction:
After creating the index through zipkin, then delete the index data of the day through the graphical interface
The shard of the regenerated index after deletion becomes 0, and the index created before deletion has 5 shards by default