I had to remove my elasticsearch data folder to get by a Kibana issue that's not allowing me to get back into the Watches management section.
After getting back into the Watches management section, I copy-pasted in the JSON for the watch I had been using for Heartbeat ping status, but when I try to simulate or execute the watch now I'm getting the following failure:
"Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
I wasn't getting this problem before with the same watch. What could the problem be?
{
"watch_id": "_inlined_",
"node": "IFLmN_enSMy4r8OWPr-nzA",
"state": "failed",
"status": {
"state": {
"active": true,
"timestamp": "2018-07-16T16:21:17.625Z"
},
"actions": {
"send_email": {
"ack": {
"timestamp": "2018-07-16T16:21:17.625Z",
"state": "awaits_successful_execution"
}
}
},
"execution_state": "failed",
"version": -1
},
"trigger_event": {
"type": "manual",
"triggered_time": "2018-07-16T16:21:17.631Z",
"manual": {
"schedule": {
"scheduled_time": "2018-07-16T16:21:17.631Z"
}
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"from": "now-15m"
}
}
}
]
}
},
"aggregations": {
"by_monitors": {
"terms": {
"field": "monitor.host",
"size": 100,
"min_doc_count": 1
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"metadata": {
"name": "Ping test systems",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2018-07-16T16:21:17.638Z",
"execution_duration": 80,
"input": {
"type": "search",
"status": "failure",
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": "heartbeat-6.3.0-2018.07.16",
"node": "IFLmN_enSMy4r8OWPr-nzA",
"reason": {
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
}
],
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"from": "now-15m"
}
}
}
]
}
},
"aggregations": {
"by_monitors": {
"terms": {
"field": "monitor.host",
"size": 100,
"min_doc_count": 1
}
}
}
}
}
}
},
"actions": []
},
"messages": [
"failed to execute watch input"
]
}