# Field data type is 'ip' but still fielddata is load during query

**URL:** <https://discuss.elastic.co/t/field-data-type-is-ip-but-still-fielddata-is-load-during-query/379833>\
**Category:** Elasticsearch\
**Created:** [July 6, 2025, 6:04pm UTC](https://discuss.elastic.co/t/field-data-type-is-ip-but-still-fielddata-is-load-during-query/379833 "2025-07-06T18:04:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kuldeep\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuldeep_gupta/32/88162_2.png) [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\
**Post date:** [July 6, 2025, 6:04pm UTC](https://discuss.elastic.co/t/field-data-type-is-ip-but-still-fielddata-is-load-during-query/379833/1 "2025-07-06T18:04:32Z")

</div>

Hello everyone,  
I have data stored in elasticsearch. In documents i have multiple fields in which i have **source** and **destination** field with datatype **ip**.Please find below output of

> GET index-name/\_mapping/

Sorry can't share full mapping because the list is very lengthy.

```auto
{
        "source": {
          "type": "ip"
        },
        "destination":{
          "type":"ip"
        }
}

```

Now in my elasticsearch cluster i am frequently experiencing circuit breaker exception

```auto
Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: [parent] Data too large, data for [indices:data/write/bulk[s]] would be [32045611070/29.8gb], which is larger than the limit of [31621696716/29.4gb], real usage: [32045606600/29.8gb], new bytes reserved: [4470/4.3kb], usages [fielddata=15790595258/14.7gb, request=36864/36kb, inflight_requests=488696/477.2kb, model_inference=0/0b, eql_sequence=0/0b]

```

I am getting fielddata usage **14GB** but in my mapping i haven't enabled field data to **true**.

Now when i ran below command

> GET /\_cat/fielddata?v=true

what i get that **destination** field size is **5.5gb**.

Can someone please help what could be the issue here.  
If there is any more information required please tell me.

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [July 7, 2025, 3:21pm UTC](https://discuss.elastic.co/t/field-data-type-is-ip-but-still-fielddata-is-load-during-query/379833/2 "2025-07-07T15:21:21Z")

</div>

are you sure there is a) there are not other indices with a field called **destination** and b) the mapping type for all fields called **destination** is "ip", across **all** indices in the cluster.

That said, the error:

```auto
Data too large, data for [indices:data/write/bulk[s]] would be [32045611070/29.8gb],

```

What were you/your team trying to do at the time that specific error was generated ?

---

<div class="post-metadata">

**Author:** ![kuldeep\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuldeep_gupta/32/88162_2.png) [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\
**Post date:** [July 8, 2025, 5:56am UTC](https://discuss.elastic.co/t/field-data-type-is-ip-but-still-fielddata-is-load-during-query/379833/3 "2025-07-08T05:56:30Z")

</div>

Hello Sir,  
a) I have mutiple indices like spark--\* pattern in which both source and destination fields are there.  
b) yes i have checked the data mapping.

In our cluster data injection is continuous and at that time aggregation query on destination field was executed.