# Having Issues query since upgraded to ES 5.6
**URL:** https://discuss.elastic.co/t/having-issues-query-since-upgraded-to-es-5-6/105663
**Category:** Elasticsearch
**Created:** [October 29, 2017, 1:43pm UTC](https://discuss.elastic.co/t/having-issues-query-since-upgraded-to-es-5-6/105663 "2017-10-29T13:43:57Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)
#### Post date: [October 29, 2017, 1:43pm UTC](https://discuss.elastic.co/t/having-issues-query-since-upgraded-to-es-5-6/105663/1 "2017-10-29T13:43:57Z")
Hello,
I recently updated our security dashboard Elasticsearch based version to latest 5.63 , since then we having issues in some of our visualization , i can see its related to “Fielddata is disabled on text fields” , any suggestion for fixing it, or another way to query same result?
Thanks
{
"root\_cause": [
{
"type": "illegal\_argument\_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [SrcIp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
],
"type": "search\_phase\_execution\_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed\_shards": [
{
"shard": 0,
"index": "ids\_sensors",
"node": "pYd\_mhyPTvO01n9wGK1pLQ",
"reason": {
"type": "illegal\_argument\_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [SrcIp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
}
]
}
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [October 29, 2017, 4:44pm UTC](https://discuss.elastic.co/t/having-issues-query-since-upgraded-to-es-5-6/105663/2 "2017-10-29T16:44:05Z")
The problem is that the `SrcIp` field is a `text` field and elasticsearch no longer builds field data for text fields by default. The suggestion on how to fix it is actually in the text of the error message that you posted
> [@Tal\_Bar\_Or](#):
>
> Set fielddata=true on [SrcIp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
In other words you need to set the mapping for this field to `keyword` or use `SrcIp.keyword` field instead if you used dynamic mapping, or you need to enable fielddata on this field if first two suggestions don't work for you for some reason.
Please see the ["Fielddata is disabled on text fields by default"](https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html#_fielddata_is_disabled_on_literal_text_literal_fields_by_default) section of the elasticsearch documentation for more information.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 26, 2017, 4:44pm UTC](https://discuss.elastic.co/t/having-issues-query-since-upgraded-to-es-5-6/105663/3 "2017-11-26T16:44:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.