Aggregations don't work in Kibana after Elastic stack upgrade to 7.2

Elastic Stack Kibana
1

Aggregations don't work in Kibana after Elastic stack upgrade to 7.2 from 6.8 version. I use it to visualize logs from postfix , these are shipped ok and I can see the records in ' Discover' just OK. But when I try to visualize on any field, Kibana says 1 of XX shards failed and shows no data. The same is with the dashboards I had created in older version.
In the elasticsearch logs, it shows:
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

I have found similar topics here, regarding changing the 'text' to 'keyword', but in template, there's the correct type already. But when I look at index mapping, text type is everywhere like this:
"host": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}}}
Any ideas welcome

2

Aggregations only work for fields with fielddata enabled. By default, text fields do not have field data enabled and can not be used in aggregations. Keyword has fielddata enabled by default and can be use in aggregations

Your index mapping uses multifields to index host in 2 different ways. host is indexed as text while host.keyword is indexed as keyword.

What does the configuration look like for your visualization? Are you using host.keyword for your aggregation field?

3

I tried to use host.keyword for aggregation and in visualization before, but I couldn't either find or enter 'host.keyword' anywhere in the visualisation setup.
Do I have to use other approach to edit my old visualizations? Even if I try to create new visualization, e.g. use Terms for aggregation , it doesn't allow to enter 'host.keyword'.
Since I'm far from being expert on this,I may misunderstand how keyword must be specified here. I'd be grateful for advice, how can I adjust my visualizations from older kibana version. Thanks for any insight

4

E.g. I tried this, but there are no fields, that end with '.keyword' in my case:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.