Hello, today I went to my dashboard and saw such an error "1 of 21 shards failed", looking at the details I saw the following
Request:
{
"aggs": {
"2": {
"terms": {
"field": "agent.name",
"order": {
"1": "desc"
},
"size": 50
},
"aggs": {
"1": {
"sum": {
"field": "network.bytes"
}
}
}
}
}
{
"took": 192,
"timed_out": false,
"_shards": {
"total": 21,
"successful": 20,
"skipped": 15,
"failed": 1,
"failures": [
{
"shard": 0,
"index": "index_name",
"node": "node_name",
"reason": {
"type": "illegal_argument_exception",
"reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [agent.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
}
}
]
},
I read a little about "Fielddata", it is not recommended to set it to "true", and I looked in the mapping and did not find the "agent.name" field, only "agent" and "name" separately, both have text type and keyword. What could it be, thanks in advance.