Elk Stack 5.3 Issue with Metricbeat Dashboards on Kibana:::Visualize: Fielddata is disabled on text fields by default

Elastic Stack Beats
1

Hi,

I have installed elk stack 5.3 with metricbeat. After this I have loaded the metric beat dashboards. When I open the Kibana with any sample dashboard I am getting below error.

image.png1549×435 37.1 KB

I have read several posts. But I am not able to understand how to fix this issue?
Could any one please help?

Regards,
Ramakrishna

2

Hi

The error message you are seeing is stating that for text fields there are two way to aggregate or sort the data, either enable field data at the cost of using memory or use/add a keyword field. Field data can consume a lot of heap space, especially when loading high cardinality text fields, hence its disabled by default.
Ref : https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html#_fielddata_is_disabled_on_literal_text_literal_fields_by_default

Once you do that it will resolve the error message. More details can be found here : https://github.com/elastic/elasticsearch/issues/22768

Thanks
Rashmi

3

Hi Rashmi,

Thanks for the reply. I have seen the posts. But still the information is not clear. I have the below index on elastic search:

[root@elk-stack ~]# curl -XGET 'localhost:9200/_cat/indices?v&pretty'
health status index                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   my_index              FOKpTYq5QdCeJzShlLxzkg   5   1          0            0       795b           795b
yellow open   index                 bk3v-YO6SD-0-qAAMboa7g   5   1          0            0       795b           795b
yellow open   metricbeat-2017.04.11 lrdPCokkSgGzgAYccUI5AQ   5   1     740131            0    260.7mb        260.7mb
yellow open   metricbeat-2017.04.12 Ov_9hU8fQki4kcsmxA66XQ   5   1     586433            0    207.3mb        207.3mb
yellow open   .kibana               O4FjI-DrQY-APDIQOlmlgw   1   1         96           68    284.7kb        284.7kb

The field data enabling is required for me, because I am using Metric beats. When I use metric beats lot of information has text related data like process names, Network interface names, Host names etc..

So could you please give an example on how to enable fielddata for metricbeats?

Thanks in advance.

Regards,
Ramakrishna

4

Hi RamaKrishna,

Can you run GET /metricbeat-* in Dev tools and share the output? Also do enable fielddata:true in metricbeat.template.json . For Ex:

"id": {
              "type": "text",
              "fielddata":"true"
            },
            "image": {
              "type": "text",
              "fielddata": true
            },
            "name": {
              "type": "text",
              "fielddata":true
            },

Note that this can however use significant memory. My guess is the setting in the template file is not being propagated to ES. If you don't have any data you need to preserve, you can try deleting the index and starting again. You can also try sending data to a new index name.

Hope this helps..

Thanks
Rashmi

5

Hi Rashmi,

Many thanks for the quick reply. But The out I am not able to paste in the message or attach. How can I share the output?

Also I have only one text field in the metricbeat.template.json.

        "meta": {
          "norms": false,
          "type": "text",
          "fielddata":true

I added fielddata:true here. is this ok?

Regards,
Ramakrishna

6

Hi Rashmi,

I have uploaded the GET /metricbeat-* output in the below location.

Regards,
Ramakrishna

7

Can anyone help me on this? I see many posts related to this. But no solution.
Thanks in advance.

Regards,
Ramakrishna

8

@Ramakrishna_K If you can, I'd recommend dropping the existing metricbeat indices (DELETE /metricbeat-*) in Console, then make sure you do the following:

  • The mapping template that we provide with the Beats should be loaded. Metricbeat does that automatically, so there's usually nothing to do, but you can make sure it worked by: stop metricbeat, run DELETE /_template/metricbeat, start metricbeat again, check that GET /_template/metricbeat returns a long document.

  • The Metricbeat dashboards are loaded correctly. Run ./scripts/import_dashboards and then make sure to not refresh the index pattern in Kibana, as that can break the dashboards again.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.