Discover: Field data loading is forbidden on message


(michaelshi) #1

Was section log

************ Start Display Current Environment ************
WebSphere Platform 7.0.0.15 [ND 7.0.0.15 cf151107.06] running with process name WAS1Cell01\WAS1Node01\mobile-m1 and process id 75027
Host Operating System is Linux, version 3.0.101-63-default
Java version = 1.6.0, Java Compiler = j9jit24, Java VM name = IBM J9 VM
was.install.root = /opt/IBM/WebSphere/AppServer
user.install.root = /opt/IBM/WebSphere/AppServer/profiles/AppSrv01
Java Home = /opt/IBM/WebSphere/AppServer/java.20160106.2305/jre
ws.ext.dirs = /opt/IBM/WebSphere/AppServer/java/lib:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/classes:/opt/IBM/WebSphere/AppServer/classes:/opt/IBM/WebSphere/AppServer/lib:/opt/IBM/WebSphere/AppServer/installedChannels:/opt/IBM/WebSphere/AppServer/lib/ext:/opt/IBM/WebSphere/AppServer/web/help:/opt/IBM/WebSphere/AppServer/deploytool/itp/plugins/com.ibm.etools.ejbdeploy/runtime
Classpath = /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties:/opt/IBM/WebSphere/AppServer/properties:/opt/IBM/WebSphere/AppServer/lib/startup.jar:/opt/IBM/WebSphere/AppServer/lib/bootstrap.jar:/opt/IBM/WebSphere/AppServer/lib/jsf-nls.jar:/opt/IBM/WebSphere/AppServer/lib/lmproxy.jar:/opt/IBM/WebSphere/AppServer/lib/urlprotocols.jar:/opt/IBM/WebSphere/AppServer/deploytool/itp/batchboot.jar:/opt/IBM/WebSphere/AppServer/deploytool/itp/batch2.jar:/opt/IBM/WebSphere/AppServer/java/lib/tools.jar
Java Library path = /opt/IBM/WebSphere/AppServer/java.20160106.2305/jre/lib/amd64/compressedrefs:/opt/IBM/WebSphere/AppServer/java.20160106.2305/jre/lib/amd64:/opt/IBM/WebSphere/AppServer/bin::/usr/lib

message field type is string, filebeat using the default configuration, I use the filebeat to collect log information, but the kibana interface prompts errors, message which led to kibana can not show it?

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_state_exception","reason":"Field data loading is forbidden on message"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-log-2016.03.10","node":"8UQS3M63QwmQmuWjLX6oLw","reason":{"type":"illegal_state_exception","reason":"Field data loading is forbidden on message"}}]}}
KbnError@http://localhost:5601/bundles/commons.bundle.js?v=9693:57415:21
RequestFailure@http://localhost:5601/bundles/commons.bundle.js?v=9693:57448:1
callResponseHandlers/<@http://localhost:5601/bundles/kibana.bundle.js?v=9693:80073:39
WEBPACK_AMD_DEFINE_RESULT</</Promise.try@http://localhost:5601/bundles/commons.bundle.js?v=9693:61110:20
WEBPACK_AMD_DEFINE_RESULT</</Promise.map/<@http://localhost:5601/bundles/commons.bundle.js?v=9693:61079:17
WEBPACK_AMD_DEFINE_RESULT</</Promise.map@http://localhost:5601/bundles/commons.bundle.js?v=9693:61078:27
callResponseHandlers@http://localhost:5601/bundles/kibana.bundle.js?v=9693:80045:1
fetchWithStrategy/<@http://localhost:5601/bundles/kibana.bundle.js?v=9693:79552:17
processQueue@http://localhost:5601/bundles/commons.bundle.js?v=9693:42356:29
scheduleProcessQueue/<@http://localhost:5601/bundles/commons.bundle.js?v=9693:42372:28
$RootScopeProvider/this.$get</Scope.prototype.$eval@http://localhost:5601/bundles/commons.bundle.js?v=9693:43600:17
$RootScopeProvider/this.$get</Scope.prototype.$digest@http://localhost:5601/bundles/commons.bundle.js?v=9693:43411:16
$RootScopeProvider/this.$get</Scope.prototype.$apply@http://localhost:5601/bundles/commons.bundle.js?v=9693:43708:14
done@http://localhost:5601/bundles/commons.bundle.js?v=9693:38157:37
completeRequest@http://localhost:5601/bundles/commons.bundle.js?v=9693:38355:8
requestLoaded@http://localhost:5601/bundles/commons.bundle.js?v=9693:38296:1


(Matt Bargar) #2

Can you post the full mapping for your message field? You can do that by issuing a request like this:

GET <elasticsearchHost>:port/*/_mapping/*/field/message

Also, what versions of ES, Kibana, and Filebeat are you using?


(system) #3