Fielddata is disabled on text fields

Elastic Stack Elasticsearch
1

So an error I'm receiving for "logstash-2019.08.19" is "Fielddata is disabled on text fields by default. Set fielddata=true on [time] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."

However, I use "time" as a date datatype. Is there something about the date type that is treated as a text type?

  "template": "logstash-*",
  "order": 1, 
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },
  "mappings": 
  {
    "syslog": 
    {
      "properties": 
      {
        "time": {
          "type": "date",
          "format": "basic_time_no_millis"
        },
        "before": {
          "type": "date",
          "format": "strict_date_time"
        },
        "after": {
          "type": "date",
          "format": "strict_date_time"
        },
        "logsource": {
          "type": "ip"
        }
      }
    } 
  }

simply enabling fielddata on "time" does not resolve the error.

2

checking the mapping for the index shows the following for "time":

"time" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },

so i have the proper unanalyzed keyword field set, yet the error persists.

3

Hey,

instead of enabling fielddata, you can just use time.keyword in this case. However I am wondering why time is a string based field here....

--Alex

4

In the conf file i explicitly add time as such

 add_field => {
      "time" => "%{+HHmmssZ}"
      "weekday" => "%{+EEE}"
    }

could it be that this is not within the dynamic template's date detection list? That format, of time with no milliseconds seemed valid to me, yet it seems that even tho i specify time as a type date it responds with a type text

5

this only looks like a time without a date, so it is hard to infer a date out of that - which then makes perfect sense that it is parsed as text unless specifically configured in the mapping.