"Fielddata is disabled on text fields by default" error on keyword field

Elastic Stack Elasticsearch
1

I'm getting this error in my log:

Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [component] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
        at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:670) ~[elasticsearch-6.5.0.jar:6.5.0]

Which I don't understand. For this index we have a dynamic template containing:

{
    "template" : "logs_rikstv_app_log*generic*",
    "order" : 1,
    "settings": {
        "index": {
            "refresh_interval": "5s"
        }
    },
    "mappings": {
        "generic": {
            "dynamic_templates": [
                {
                    "notanalyzed": {
                        "match_mapping_type": "string",
                        "mapping": {
                            "type": "keyword"
                        },
                        "match": "*"
                    }
                }
            ],
            "properties": {
                "@timestamp": {
                    "type": "date"
                },
                "errorid": {
                    "type": "integer"
                }
            }
        }
    }
}

If I query the actual index for its mappings I get (subset):

                "properties": {
                    "@timestamp": {
                        "type": "date"
                    },
                    "@version": {
                        "type": "keyword"
                    },
                    "Exception": {
                        "type": "keyword"
                    },
                    "Level": {
                        "type": "keyword"
                    },
                    "beat": {
                        "properties": {
                            "hostname": {
                                "type": "keyword"
                            },
                            "name": {
                                "type": "keyword"
                            },
                            "version": {
                                "type": "keyword"
                            }
                        }
                    },
                    "component": {
                        "type": "keyword"
                    },

So, given the fact that the component field is a keyword type, why am I getting this error? I'm sure there's something I don't understand, any pointers appreciated!

2

Does your index pattern match more than one index? Is this mapping consistent across all indices matched by the pattern?

3

It does match multiple, but the error from Elasticsearch is related to the index I've posted the mapping for above as far as I can see. I'll go thru them all to see if there are diffs.

4

You're absolutely right. There are some type discrepancies. Thanks for the pointer!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.