# 1 of 21 shards failed **URL:** \ **Category:** Elasticsearch\ **Created:** [March 31, 2022, 9:17pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259 "2022-03-31T21:17:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Post date:** [March 31, 2022, 9:17pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/1 "2022-03-31T21:17:55Z")
Hello, today I went to my dashboard and saw such an error "1 of 21 shards failed", looking at the details I saw the following ```auto Request: { "aggs": { "2": { "terms": { "field": "agent.name", "order": { "1": "desc" }, "size": 50 }, "aggs": { "1": { "sum": { "field": "network.bytes" } } } } } ``` ```auto { "took": 192, "timed_out": false, "_shards": { "total": 21, "successful": 20, "skipped": 15, "failed": 1, "failures": [ { "shard": 0, "index": "index_name", "node": "node_name", "reason": { "type": "illegal_argument_exception", "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [agent.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory." } } ] }, ``` I read a little about "Fielddata", it is not recommended to set it to "true", and I looked in the mapping and did not find the "agent.name" field, only "agent" and "name" separately, both have text type and keyword. What could it be, thanks in advance. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 31, 2022, 10:40pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/2 "2022-03-31T22:40:51Z")
Could you share the mapping? I guess that `agent.name.keyword` should be used instead? ---
**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Post date:** [April 1, 2022, 7:45am UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/3 "2022-04-01T07:45:41Z")
```auto "agent" : { "properties" : { "ephemeral_id" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 ``` ```auto "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 ``` they exist only separately, unlike all other fields In the "discover" section, if you click on the agent.name field, then the agent.name.keyword field exists ![1111](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e084bde291560d314d614463814e1ca09023304d.png) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 1, 2022, 12:33pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/4 "2022-04-01T12:33:17Z")
Could you share the full mapping? I'm missing some elements here. ---
**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Post date:** [April 1, 2022, 12:42pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/5 "2022-04-01T12:42:55Z")
```auto { "logs-vpn-template" : { "mappings" : { "properties" : { "@timestamp" : { "type" : "date" }, "@version" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "agent" : { "properties" : { "ephemeral_id" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "hostname" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "id" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "type" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "version" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "ecs" : { "properties" : { "version" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "host" : { "properties" : { "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "input" : { "properties" : { "type" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "ipsec" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "log" : { "properties" : { "file" : { "properties" : { "path" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "offset" : { "type" : "long" } } }, "message" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "openvpn" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "openvpn_user" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "tags" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "user_ipsec" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 29, 2022, 12:43pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259/6 "2022-04-29T12:43:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.