title: "(key) field [@timestamp] not found" after restarting elasticsearch node
body: <p>I'm attempting to use logstash to feed documents into elasticsearch which I could then query using the kibana web interface.  I am currently running a single elasticsearch node fed by logstash tailing apache access logs for testing purposes so that I can learn how to use logstash and elasticsearch before scaling up to multiple elasticsearch nodes in a cluster and log aggregation across multiple hosts and services with logstash.</p>
  
  <p>I was able to successfully build an ES database last night by feeding it documents using logstash and I was able to query against it using kibana.  However, today, when I started my ES node again, I see the following error when attempting to run a query:</p>
  
  <pre><code>[2014-10-10 13:11:53,437][DEBUG][action.search.type       ] [Madam Slay] All shards failed for phase: [query]
  </code></pre>
  
  <p>(The full log is available <a href="http://pastebin.com/hv7dhaa2" rel="nofollow">here</a>.)</p>
  
  <p>The health of my node seems to be just fine:</p>
  
  <pre><code>[pitserver ~/local/tmp/elasticsearch-1.3.4]% curl -XGET "http://localhost:9200/_cluster/health?pretty=true"
  {
    "cluster_name" : "elasticsearch",
    "status" : "yellow",
    "timed_out" : false,
    "number_of_nodes" : 1,
    "number_of_data_nodes" : 1,
    "active_primary_shards" : 2520,
    "active_shards" : 2520,
    "relocating_shards" : 0,
    "initializing_shards" : 0,
    "unassigned_shards" : 2520
  }
  </code></pre>
  
  <p>I tried restarting the node several times.  The <code>data</code> directory ostensibly contains the same data that it did yesterday.</p>
  
  <p>After learning a bit more about how kibana queries against elasticsearch, I believe that the most relevant error in the log file is this one:</p>
  
  <pre><code>(key) field [@timestamp] not found
  </code></pre>
  
  <p>I have learned that this error pops up when attempting to draw a histogram that contains date(s) that don't correspond to an existing logstash index in elasticsearch.  I have found an <a href="https://github.com/elasticsearch/kibana/issues/834" rel="nofollow">(closed) issue report on kibana's GitHub page that describes the problem I am having</a>.  The workaround is to only draw a histogram against dates that correspond to existing logstash indices in my elasticsearch database.</p>
  
  <p>What doesn't make sense to me is that I was able to query by the timestamp field yesterday.  But elasticsearch has problems with the nonexistent timestamp fields today after restarting the elasticsearch cluster.</p>
  
  <p>Why do I only see this problem after restarting elasticsearch?</p>