Can't load metricbeat data: Fielddata is disabled on text fields by default

Elastic Stack Beats
1

I'm not sure what caused this, possibly my previous attempt to use logstash, or an index I once tried on metricbeat. I now send beats directly to elasticsearch. I'm using 7.1 for all parts of the ELK stack.

From the Infrastructure screen, if I click "View Metrics" on a host, I get an error in elasticsearch:

"Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.",
     "at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:767) ~[elasticsearch-7.1.0.jar:7.1.0]",
     "at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:116) ~[elasticsearch-7.1.0.jar:7.1.0]", 
    ...

Things I've tried

  • Deleting all indices
  • Deleting all templates
  • Query using curl to try and fix the mapping, but cannot form the correct syntax for query

Please let me know other things I can try. This is breaking my metric data visualization, and I'm considering rolling back to 6.7 as I've seen that suggested.

2

Go to infrastructure -> Configuration
Under Fields section theres Host name Input for the host name field
change it from host.name to host.name.keyword
that should do the job.

3

I found the issue. I was somehow using an older version of the metricbeat.yml file. Once I got a fresh YML file and configured it, everything works as expected. This was a huge headache and I hope this helps someone as not many people have had this issue it seems. :smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.