Data too large, data for [_id] would be [12177806640/11.3gb]

Hi,

Just had a cluster failure with the above error message.
I understand I need to change or duplicate _id field and disable fielddata on it.
Couple of questions:

1 - How can I tell what search query\dashboard etc had caused this issue?
2 - Is it safe to disable fielddata on _id in general?

Thanks
X