I have an error that appears when entering a dashboard in kibana, no data in the visualizations, everything comes out blank; these visualizations are of filebeat that the service works correctly, but this error comes out:
[timelion_vis] > Timelion request error: undefined Error: in cell #1: [illegal_argument_exception] Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [destination.as.organization.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory.
It looks like the problem is that destination.as.organization.name is not available for aggregations.
The error says, that in the visualizations you should use the field of type keyword Keyword type family | Elasticsearch Guide [7.12] | Elastic (if you use default mappings then probably already have destination.as.organization.name.keyword and you could try to use that one in your viz) or alternatively you could enable field data on your field of type text Text field type | Elasticsearch Guide [7.12] | Elastic
I suspect that in your case it would make sense for the organization name to be of a type keyword.
when changing to keyword the visualization works but the same error is still displayed, look at the index fields and there is already one with the keyword
Looks like other visualizations on that dashboard are still using destination.as.organization.name, hence there are errors. I'd try to change all visualizations to use a keyword field
I already did for the Timelion visualizations but for the normal graphs the .keyword is not in destination.as.organization.name so it does not work for me, and that field is not aggregatable, how do I transform it to keyword?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
