# Discover: Field data loading is forbidden on message

**URL:** <https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-message/43980>\
**Category:** Kibana\
**Created:** [March 10, 2016, 5:50am UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-message/43980 "2016-03-10T05:50:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![szcountryboy](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\
**Post date:** [March 10, 2016, 5:50am UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-message/43980/1 "2016-03-10T05:50:13Z")

</div>

Was section log

> \*\*\*\*\*\*\*\*\*\*\*\* Start Display Current Environment \*\*\*\*\*\*\*\*\*\*\*\*  
> WebSphere Platform 7.0.0.15 [ND 7.0.0.15 cf151107.06] running with process name WAS1Cell01\WAS1Node01\mobile-m1 and process id 75027  
> Host Operating System is Linux, version 3.0.101-63-default  
> Java version = 1.6.0, Java Compiler = j9jit24, Java VM name = IBM J9 VM  
> was.install.root = /opt/IBM/WebSphere/AppServer  
> user.install.root = /opt/IBM/WebSphere/AppServer/profiles/AppSrv01  
> Java Home = /opt/IBM/WebSphere/AppServer/java.20160106.2305/jre  
> ws.ext.dirs = /opt/IBM/WebSphere/AppServer/java/lib:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/classes:/opt/IBM/WebSphere/AppServer/classes:/opt/IBM/WebSphere/AppServer/lib:/opt/IBM/WebSphere/AppServer/installedChannels:/opt/IBM/WebSphere/AppServer/lib/ext:/opt/IBM/WebSphere/AppServer/web/help:/opt/IBM/WebSphere/AppServer/deploytool/itp/plugins/com.ibm.etools.ejbdeploy/runtime  
> Classpath = /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties:/opt/IBM/WebSphere/AppServer/properties:/opt/IBM/WebSphere/AppServer/lib/startup.jar:/opt/IBM/WebSphere/AppServer/lib/bootstrap.jar:/opt/IBM/WebSphere/AppServer/lib/jsf-nls.jar:/opt/IBM/WebSphere/AppServer/lib/lmproxy.jar:/opt/IBM/WebSphere/AppServer/lib/urlprotocols.jar:/opt/IBM/WebSphere/AppServer/deploytool/itp/batchboot.jar:/opt/IBM/WebSphere/AppServer/deploytool/itp/batch2.jar:/opt/IBM/WebSphere/AppServer/java/lib/tools.jar  
> Java Library path = /opt/IBM/WebSphere/AppServer/java.20160106.2305/jre/lib/amd64/compressedrefs:/opt/IBM/WebSphere/AppServer/java.20160106.2305/jre/lib/amd64:/opt/IBM/WebSphere/AppServer/bin::/usr/lib

message field type is string, filebeat using the default configuration, I use the filebeat to collect log information, but the kibana interface prompts errors, message which led to kibana can not show it?

> Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"illegal\_state\_exception","reason":"Field data loading is forbidden on message"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"logstash-log-2016.03.10","node":"8UQS3M63QwmQmuWjLX6oLw","reason":{"type":"illegal\_state\_exception","reason":"Field data loading is forbidden on message"}}]}}  
> KbnError@[http://localhost:5601/bundles/commons.bundle.js?v=9693:57415:21](http://localhost:5601/bundles/commons.bundle.js?v=9693:57415:21)  
> RequestFailure@[http://localhost:5601/bundles/commons.bundle.js?v=9693:57448:1](http://localhost:5601/bundles/commons.bundle.js?v=9693:57448:1)  
> callResponseHandlers/\<@[http://localhost:5601/bundles/kibana.bundle.js?v=9693:80073:39](http://localhost:5601/bundles/kibana.bundle.js?v=9693:80073:39)  
> **WEBPACK\_AMD\_DEFINE\_RESULT** \</\</Promise.try@[http://localhost:5601/bundles/commons.bundle.js?v=9693:61110:20](http://localhost:5601/bundles/commons.bundle.js?v=9693:61110:20)  
> **WEBPACK\_AMD\_DEFINE\_RESULT** \</\</Promise.map/\<@[http://localhost:5601/bundles/commons.bundle.js?v=9693:61079:17](http://localhost:5601/bundles/commons.bundle.js?v=9693:61079:17)  
> **WEBPACK\_AMD\_DEFINE\_RESULT** \</\</Promise.map@[http://localhost:5601/bundles/commons.bundle.js?v=9693:61078:27](http://localhost:5601/bundles/commons.bundle.js?v=9693:61078:27)  
> callResponseHandlers@[http://localhost:5601/bundles/kibana.bundle.js?v=9693:80045:1](http://localhost:5601/bundles/kibana.bundle.js?v=9693:80045:1)  
> fetchWithStrategy/\<@[http://localhost:5601/bundles/kibana.bundle.js?v=9693:79552:17](http://localhost:5601/bundles/kibana.bundle.js?v=9693:79552:17)  
> processQueue@[http://localhost:5601/bundles/commons.bundle.js?v=9693:42356:29](http://localhost:5601/bundles/commons.bundle.js?v=9693:42356:29)  
> scheduleProcessQueue/\<@[http://localhost:5601/bundles/commons.bundle.js?v=9693:42372:28](http://localhost:5601/bundles/commons.bundle.js?v=9693:42372:28)  
> $RootScopeProvider/this.$get\</Scope.prototype.$eval@[http://localhost:5601/bundles/commons.bundle.js?v=9693:43600:17](http://localhost:5601/bundles/commons.bundle.js?v=9693:43600:17)  
> $RootScopeProvider/this.$get\</Scope.prototype.$digest@[http://localhost:5601/bundles/commons.bundle.js?v=9693:43411:16](http://localhost:5601/bundles/commons.bundle.js?v=9693:43411:16)  
> $RootScopeProvider/this.$get\</Scope.prototype.$apply@[http://localhost:5601/bundles/commons.bundle.js?v=9693:43708:14](http://localhost:5601/bundles/commons.bundle.js?v=9693:43708:14)  
> done@[http://localhost:5601/bundles/commons.bundle.js?v=9693:38157:37](http://localhost:5601/bundles/commons.bundle.js?v=9693:38157:37)  
> completeRequest@[http://localhost:5601/bundles/commons.bundle.js?v=9693:38355:8](http://localhost:5601/bundles/commons.bundle.js?v=9693:38355:8)  
> requestLoaded@[http://localhost:5601/bundles/commons.bundle.js?v=9693:38296:1](http://localhost:5601/bundles/commons.bundle.js?v=9693:38296:1)

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [March 11, 2016, 4:44pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-message/43980/2 "2016-03-11T16:44:09Z")

</div>

Can you post the full mapping for your `message` field? You can do that by issuing a request like this:

`GET <elasticsearchHost>:port/*/_mapping/*/field/message`

Also, what versions of ES, Kibana, and Filebeat are you using?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:59pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-message/43980/3 "2017-07-06T13:59:27Z")

</div>