Hello,
as you can see in the title, i got this famous error, let me explain :
I've created a data table, created a sub-bucket for timestamp, then created a other with beat.name, but when i create a sub-bucket with beat.name, host.name or the path of log, i get this error.
Here is the elasticsearch server logs :
[2018-08-07T10:07:32,166][DEBUG][o.e.a.s.TransportSearchAction] [node-test] [filebeat-2018.08.03][2], node[JhMsbp-VTbeJjFKqXeYO6g], [P], s[STARTED], a[id=ubmz5pzySKOcfaajRm3wDw]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[filebeat*], indicesOptions=IndicesOptions[id=39, ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false], types=[], routing='null', preference='1533628840800', requestCache=null, scroll=null, maxConcurrentShardRequests=5, batchedReduceSize=512, preFilterShardSize=64, allowPartialSearchResults=true, source={"size":0,"query":{"bool":{"must":[{"match_all":{"boost":1.0}},{"range":{"@timestamp":{"from":1533592800000,"to":1533679199999,"include_lower":true,"include_upper":true,"format":"epoch_millis","boost":1.0}}},{"range":{"@timestamp":{"from":1533592800000,"to":1533679199999,"include_lower":true,"include_upper":true,"format":"epoch_millis","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":["@timestamp"],"script_fields":{},"aggregations":{"other-filter":{"filters":{"filters":{"":{"bool":{"must":[{"exists":{"field":"@timestamp","boost":1.0}}],"must_not":[{"match_phrase":{"@timestamp":{"query":1533604155374,"slop":0,"zero_terms_query":"NONE","boost":1.0}}},{"match_phrase":{"@timestamp":{"query":1533592837427,"slop":0,"zero_terms_query":"NONE","boost":1.0}}},{"match_phrase":{"@timestamp":{"query":1533601836891,"slop":0,"zero_terms_query":"NONE","boost":1.0}}},{"match_phrase":{"@timestamp":{"query":1533610840587,"slop":0,"zero_terms_query":"NONE","boost":1.0}}},{"match_phrase":{"@timestamp":{"query":1533622154278,"slop":0,"zero_terms_query":"NONE","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}}},"other_bucket":false,"other_bucket_key":"_other_"},"aggregations":{"5":{"terms":{"field":"beat.name","size":5,"min_doc_count":1,"shard_min_doc_count":0,"show_term_doc_count_error":false,"order":[{"_count":"desc"},{"_key":"asc"}]}}}}}}}] lastShard [true]
org.elasticsearch.transport.RemoteTransportException: [node-test][192.168.250.224:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:518) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:115) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.index.query.QueryShardContext.getForField(QueryShardContext.java:165) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.support.ValuesSourceConfig.resolve(ValuesSourceConfig.java:96) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:318) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:311) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:38) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:139) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:329) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.AggregatorFactory.<init>(AggregatorFactory.java:187) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.bucket.filter.FiltersAggregatorFactory.<init>(FiltersAggregatorFactory.java:49) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.bucket.filter.FiltersAggregationBuilder.doBuild(FiltersAggregationBuilder.java:222) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:139) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:329) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService.parseSource(SearchService.java:766) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService.createContext(SearchService.java:575) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:551) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:347) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:333) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:329) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.search.SearchService$3.doRun(SearchService.java:1019) ~[elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:725) [elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) [elasticsearch-6.3.2.jar:6.3.2]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.3.2.jar:6.3.2]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_181]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_181]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]
I can't find what's wrong maybe i need those fields to be keyword type, but i don't know how to update them, and i don't want to activate the fielddata as people say that it consume too much memory, only have 10gb free.
So, do someone know what can cause this error ?