Just had a cluster failure with the above error message.
I understand I need to change or duplicate _id field and disable fielddata on it.
Couple of questions:
1 - How can I tell what search query\dashboard etc had caused this issue?
2 - Is it safe to disable fielddata on _id in general?