Filebeat & Kibana error: "Visualize: Fielddata is disabled on text fields by default."

[rootameen (Ameen Ali)]

Hi guys,
I recently started a new setup of ELK stack based on version 5.1. Everything went smoothly except for the visualization section on Kibana. Whenever I try to create something (like a visual of beat.name), I get the error message:

Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory.

I'm currently using filebeat to ship all my log messages, and I've checked the official documentation and came across this link: fielddata | Elasticsearch Guide [5.0] | Elastic

I tried to apply it on my setup but I just can't figure out what exactly to put in the curl statement to reflect this change on logs. What should I relpace "/my_index/_mapping/my_type" with?

I appreciate your help.

Thanks.

[tsullivan (Tim Sullivan)]

I'm currently using filebeat to ship all my log messages, and I've checked the official documentation and came across this link: fielddata | Elasticsearch Guide [5.0] | Elastic

Check the Filebeat documentation, and you will find that you can control the mapping template from Filebeat by updating filebeat.template.json. That will give you an assistance in having it work from the start, but it only applies if you are using the output.elasticsearch option in Filebeat. If you are shipping your beats to Logstash, check the Logstash documentation on the template setting to the Elasticsearch output.

@rootameen

What should I relpace "/my_index/_mapping/my_type" with?

I recommend setting up your Filebeat or Elasticsearch to load the index template before you start indexing documents, because you can't change the mapping for existing documents in Elasticsearch.

If you want to use curl to do this, the new mapping will apply the next time you create a new index with the index pattern, i.e. when daily rotation creates a new index with a new timestamp in the name. You replace /my_index/_mapping/my_type with the name of your index and type. Look at one of your documents in Discover in Kibana, and in the Table view or JSON view, those names will be the _index and _type fields.