Datafeed is encountering errors extracting data

[Lean (Leandro)]

Hello all,

I created an advanced job in ML to analyze low_varp anomalies over AZ and EL fields of a sat dish. This is supposed -as far as I understood the concept- to give me a measure of anomalies if variance is lower than normal, which is exactly what we need.

Unfortunately as soon as job runs and takes data, an IllegalArgumentException is raised, complaining that "Fielddata is disabled on text fields by default. Set fielddata=true on [antenna] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."

Of course I started looking for keyword fields to solve the problem.
What is intriguing to me is that I could not select "antenna.keyword" field to configure job: the only field that appears is the non-keyword counterpart, even though logstash already added it in ES index pattern config.

Are there any settings I overlooked or "rookie" mistakes in my job config? (please see image).

Thanks again!
Leandro.

[dkyle (David Kyle)]

Hi Leandro,

In the 5.5 release you can select a .keyword field. If you can upgrade to the latest release you will be able to use that job configuration.

[Lean (Leandro)]

Thanks David.

I upgraded from previous (5.4.1) to latest release in order to be able to use .keyword fields.

Since the upgrade, now monitoring screen gives "Error 404 Not Found: undefined" error as attached.

Is this something to do with previous monitoring indices saved with old version?

Also, in syslog I found this repetitive message:

Unhandled rejection [security_exception] missing authentication token for REST request [/_xpack], with { header={ WWW-Authenticate="Basic realm="security" charset="UTF-8"" } } :: {"path":"/_xpac
at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:295:15)
at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:254:7)
at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:159:7)
at IncomingMessage.bound (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/dist/lodash.js:729:21)
at emitNone (events.js:91:20)
at IncomingMessage.emit (events.js:185:7)
at endReadableNT (_stream_readable.js:974:12)
at _combinedTickCallback (internal/process/next_tick.js:80:11)
at process._tickDomainCallback (internal/process/next_tick.js:128:9)

I reset all users again, as I had to reinstall x-packs in every cluster node, and reinstall kibana itself.

Do you guys prefer this to be saved into a new post?

Thank you!
Leandro.

[dkyle (David Kyle)]

Hi Leandro,

Yes could you move this to a new post in X-Pack discuss please.

[Lean (Leandro)]

Yes, sure.