Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index

[skdasari (Kumar)]

Hello,

Something weird happend lately in my elasticsearch setup letely. Metricbeat index got replaced with a new name like the old one is like metricbeat.x.date, But now the index is showing as metricbeat .version and when trying to visualize. I am getting the bellow error.

Error:

[esaggs] > Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"metricbeat-7.2.1","node":"iD4ffU_sR2-uLU_SP01Ukw","reason":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}],"caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}},"status":400}

Tried solutions:

Provided the following in console.

PUT my_index/_doc/host.name.keyword
{
"properties": {
"my_field": {
"type": "text",
"fielddata": true
}
}
}

output:
{
"_index" : "my_index",
"_type" : "_doc",
"_id" : "host.name",
"_version" : 1,
"_seq_no" : 0,
"_primary_term" : 1,
"found" : true,
"_source" : {
"properties" : {
"my_field" : {
"type" : "text",
"fielddata" : true
}
}
}
}

And also

PUT my_index/_doc/host.name
{
"properties": {
"my_field": {
"type": "text",
"fielddata": true
}
}
}

Output:
{
"_index" : "my_index",
"_type" : "_doc",
"_id" : "host.name",
"_version" : 2,
"result" : "updated",
"_shards" : {
"total" : 2,
"successful" : 1,
"failed" : 0
},
"_seq_no" : 2,
"_primary_term" : 2
}

Can any one help me out on my issue.

[jsoriano (Jaime Soriano)]

Hi @skdasari,

Could you tell a little bit more about your deployment?

Was it a new deployment or an existing one? Did it happen after an upgrade?

This kind of errors use to happen when there is some kind of issue with index mapping. Did you run the Metricbeat setup?

[skdasari (Kumar)]

I think it might be an issue with the index mapping recently I have setup a lifecycle policy for the metricbeat index as it has like one month hot phase by default. I set it to one week and then applied delete phase to the policy. After this the index got messed up showing this error. Not sure what to do here because even after deleting the exxisting index the newly formed index is also giving the same error

[jsoriano (Jaime Soriano)]

When beats use ILM (as is the default since 7.0), they write to an index alias, usually <beat name>-<version>, that points to a real index that uses to contain in its name the date of creation.
If you remove the alias while the beat is running, it will continue writing to <beat name>-<version>. As it won't exist, Elasticsearch will create a new index without mapping, that could cause issues like the ones you are experiencing.
To confirm that, check if you have ILM enabled, and if metricbeat-<version> is an alias or an actual index.

To solve this, you should stop all Metricbeat instances that are writing to the index metricbeat-<version>, then remove or rename this index, and then start Metricbeat again. When Metricbeat starts it creates all the indexes and ILM configurations it needs if they don't already exist.

[skdasari (Kumar)]

@jsoriano

Sure I will try to do this because whatever I try it's showing the same error.

Thanks,
Dasari.