Fieldata

Elastic Stack Elasticsearch
1

Good Morning ALL,

I need to set the Fielddata, but cannot find where I should add this.

Am having the below error when trying to access source.

Oct 27 10:50:38 itnetgraylog elasticsearch: [2017-10-27 10:50:38,700][DEBUG][action.search ] [g0_RYrN] All shards failed for phase: [query_fetch]
Oct 27 10:50:38 itnetgraylog elasticsearch: RemoteTransportException[[g0_RYrN][127.0.0.1:9300][indices:data/read/search[phase/query+fetch]]]; nested: IllegalArgumentException[Fielddata is disabled on text fields by default. Set fielddata=true on [source] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory.];
Oct 27 10:50:38 itnetgraylog elasticsearch: Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [source] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory.
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.index.mapper.core.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:296)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:111)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.config(ValuesSourceAggregationBuilder.java:355)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:305)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:299)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:49)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:211)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.AggregatorFactory.(AggregatorFactory.java:187)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.bucket.filter.FilterAggregatorFactory.(FilterAggregatorFactory.java:43)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.bucket.filter.FilterAggregationBuilder.doBuild(FilterAggregationBuilder.java:77)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:211)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.SearchService.parseSource(SearchService.java:695)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.SearchService.createContext(SearchService.java:550)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:509)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:352)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.action.SearchTransportService$SearchQueryFetchTransportHandler.messageReceived(SearchTransportService.java:339)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.search.action.SearchTransportService$SearchQueryFetchTransportHandler.messageReceived(SearchTransportService.java:336)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.transport.TransportService$5.doRun(TransportService.java:517)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:510)
Oct 27 10:50:38 itnetgraylog elasticsearch: at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
Oct 27 10:50:38 itnetgraylog elasticsearch: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Oct 27 10:50:38 itnetgraylog elasticsearch: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
Oct 27 10:50:38 itnetgraylog elasticsearch: at java.lang.Thread.run(Thread.java:748)

The Above error from logs. When trying to call: http://itnetgraylog.corporate.intra:12900/api/sources?range=3600

Linux itnetgraylog 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 20 20:32:50 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Graylog Version: v2.3.2+3df951e
Elasticsearch Version: 5.0.0_alpha5-1
MongoDB Version: 3.4.10-1.el7
Operating System: Centos 7
Browser version: Latest Chrome/IE/Firefox

2

please dont use alpha versions, when there is a stable version since more than a year!

Maybe you just need to switch from field foo to foo.keyword and everything works. Alternatively you need to change the mapping from your field to become a keyword instead of a text field.

It is usually a really bad idea enable fielddata on analyzed fields, unless you want to use the significant terms aggregation - which BTW has a replacement on 6.0.0, which you might want to use instead. Usually there is no reason to enable fielddata anymore, as the long term plan is to remove it

3

Hey,

Thanks for your reply. Will try to make a small change and get back to you.

Thanks,David