# Advises for index **URL:** \ **Category:** Elasticsearch\ **Created:** [February 5, 2019, 1:43pm UTC](https://discuss.elastic.co/t/advises-for-index/167134 "2019-02-05T13:43:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Thibaut603](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Post date:** [February 5, 2019, 1:43pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/1 "2019-02-05T13:43:21Z")
Hello guys, i need advises because i'm a little bit lost i've a elk with one elasticsearch server one logstash server one kibana server 4 winlogbeat on 4 server(one per server) so i've many questions, - in this case think i don't need replica shards because i idon't have another elastic server right ? - in elastic log i've some warnings like this ![fielddata%20beat%20name](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7c4c46b8cdfce86e905c1ca832c648e6069cdc8.png) ![fielddata%20short%20message](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e9219d39f3c2b7e0536f507a605583c0d4354da3.png) ![fielddata](https://us1.discourse-cdn.com/elastic/original/3X/3/2/3299247d531be869dcec5ffc9505cbd7a921cfd0.png) so i need to add `fielddata=true` on those field ? my question is how ? i've see this page [https://www.elastic.co/guide/en/elasticsearch/reference/6.x/fielddata.html#\_fielddata\_is\_disabled\_on\_literal\_text\_literal\_fields\_by\_default](https://www.elastic.co/guide/en/elasticsearch/reference/6.x/fielddata.html#_fielddata_is_disabled_on_literal_text_literal_fields_by_default) and [https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) but i'm scared to do something wrong and do a big mistake thx for help ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [February 5, 2019, 2:27pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/2 "2019-02-05T14:27:03Z")
> [@Thibaut603](#): > > - in this case think i don't need replica shards because i idon't have another elastic server right ? Correct. But don't forget to increase the number of replicas if, in future, you do add another Elasticsearch node. > [@Thibaut603](#): > > - in elastic log i've some warnings like this Please don't post images of text, they're impossible to search, hard for those of us with screenreader to read, and I can't quote them in my responses. I suspect these fields should be of type `keyword` instead of `text`. How are you trying to search them? ---
**Author:** ![Thibaut603](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Post date:** [February 5, 2019, 3:01pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/3 "2019-02-05T15:01:28Z")
ok sorry for screenshots next times i'll post as code yes those field are in keyword type i search them in dashboard with visualisation i've made ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [February 5, 2019, 3:17pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/4 "2019-02-05T15:17:52Z")
> [@Thibaut603](#): > > yes those field are in keyword type i search them in dashboard with visualisation i've made I think those fields are of type `text` and not `keyword` - at least this is what the exception message seems to be saying. ---
**Author:** ![Thibaut603](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Post date:** [February 5, 2019, 3:32pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/5 "2019-02-05T15:32:12Z")
in the mapping of the index in management section i've searched those fields and all are the same like this ``` }, "TargetUserName": { "type": "keyword" }, ``` ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [February 5, 2019, 4:02pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/6 "2019-02-05T16:02:43Z")
Ok, could you share the _whole_ mapping and the _whole_ error message you're interested in understanding? ---
**Author:** ![Thibaut603](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Post date:** [February 6, 2019, 8:29am UTC](https://discuss.elastic.co/t/advises-for-index/167134/7 "2019-02-06T08:29:53Z")
Hello, sorry the whole mapping and the whole message errors is too long for one post so i've made a folder in my dropbox. so the error come when i made a search on long period and in kibana i've this message 10 of 97 shards failed. and yes i those field are in text type sorry for my mistake Link here > **[Elastic](https://www.dropbox.com/sh/g4qcr6dgtjhlv3h/AABTQYMo0w1hdeiXD7jQz8Bla?dl=0)** > > Shared with Dropbox ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [February 6, 2019, 1:30pm UTC](https://discuss.elastic.co/t/advises-for-index/167134/8 "2019-02-06T13:30:53Z")
> [@Thibaut603](#): > > and yes i those field are in text type sorry for my mistake No worries 🙂 In fact, it looks like they're being indexed as both: ```auto "beat" : { "properties" : { "hostname" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "version" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } ``` The field `beat.name` is a `text` field, but the same information is also being indexed as a `keyword` field under the name `beat.name.keyword`. I think you should be using `beat.name.keyword` rather than `beat.name` in the aggregation that your search is trying to perform: ```auto "aggregations": { "5": { "terms": { "field": "beat.name", "size": 10, "min_doc_count": 1, "shard_min_doc_count": 0, "show_term_doc_count_error": false, "order": [ { "_count": "desc" }, { "_key": "asc" } ] }, ``` ---
**Author:** ![Thibaut603](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Thibaut603](https://discuss.elastic.co/u/Thibaut603)\ **Post date:** [February 8, 2019, 7:45am UTC](https://discuss.elastic.co/t/advises-for-index/167134/9 "2019-02-08T07:45:17Z")
hello, i've tried to search with beat.name.keyword and event\_data.targetusername.keyword and no result in return but if i search with beat.username not in long period this i don't have the message. A friend suggest me to add fielddata : true on the mapping and reindex to resolv this message on long period search. it is a good idea ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 8, 2019, 7:45am UTC](https://discuss.elastic.co/t/advises-for-index/167134/10 "2019-03-08T07:45:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.