# Field data loading is forbidden on \[message\] **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [June 17, 2016, 9:09am UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134 "2016-06-17T09:09:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 17, 2016, 9:09am UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/1 "2016-06-17T09:09:45Z")
I am using winlogbeat to monitor windows log event. However, when I tried to use `message` field to do some visulaization, it pops out the message as shown in the topic. Is there any ways to solve it. I am using winlogbeat to send data to logstash in order to gather the raw data field. Other field generates raw field except message field. Is this the reason? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 17, 2016, 1:35pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/2 "2016-06-17T13:35:39Z")
Creating a visualization based on an analyzed field is not a good idea because it can use lots of heap memory. And this error is a safeguard put in place to prevent this. The index template provided by Logstash disables fielddata for analyzed fields. The index template also does not setup a multi-field for `message` so you do not get a raw field for `message`. You can customize this behavior by providing your own index templates. What are you trying to visualize using the message field? There may be alternative means of accomplishing it. Can you describe what you are trying to accomplish? ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 17, 2016, 1:48pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/3 "2016-06-17T13:48:02Z")
I am trying to make a table to map the `event_id, message, count`. However, when I add message field into the visulization, the words within the message will be break into different rows ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 17, 2016, 3:13pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/4 "2016-06-17T15:13:00Z")
The relationship between `event_id` and `message` is not one-to-one, it's one-to-many since the message is usually populated with event specific details. So I don't think you can really visualize that in a data table. You might be better off with just an event\_id and count table. Then you can select a particular event\_id from the table, pin the query, then visualize the messages over on the discover tab. If you want to make `message` a raw field you need to change the index template. Here's the Logstash template if that's what you are using: [https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json) ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 18, 2016, 2:42am UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/5 "2016-06-18T02:42:31Z")
Is that the same as the dafault es output template for logstash? Because it seems the same and I am using the default template for logstash for packetbeat. I meant except message field other field are able to generate a raw field. Thus, it seems wierd ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 20, 2016, 12:20pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/6 "2016-06-20T12:20:38Z")
Yeah, that link points to the default ES index template shipped with Logstash. > [@Kennedy\_Kan1](#): > > I meant except message field other field are able to generate a raw field. Thus, it seems wierd If you examine the template you will see that the message field is handled separately from other string fields. The message field does not have the `fields: { "raw": ... }` section which explains why you don't have a raw message field. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 11, 2016, 12:21pm UTC](https://discuss.elastic.co/t/field-data-loading-is-forbidden-on-message/53134/7 "2016-07-11T12:21:11Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.