Heartbeat monitor.status watch giving "Fielddata is disabled on text fields by default."

I had to remove my elasticsearch data folder to get by a Kibana issue that's not allowing me to get back into the Watches management section.

After getting back into the Watches management section, I copy-pasted in the JSON for the watch I had been using for Heartbeat ping status, but when I try to simulate or execute the watch now I'm getting the following failure:

"Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."

I wasn't getting this problem before with the same watch. What could the problem be?

{
  "watch_id": "_inlined_",
  "node": "IFLmN_enSMy4r8OWPr-nzA",
  "state": "failed",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2018-07-16T16:21:17.625Z"
    },
    "actions": {
      "send_email": {
        "ack": {
          "timestamp": "2018-07-16T16:21:17.625Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "failed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2018-07-16T16:21:17.631Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2018-07-16T16:21:17.631Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "monitor.status": {
                      "value": "down"
                    }
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-15m"
                    }
                  }
                }
              ]
            }
          },
          "aggregations": {
            "by_monitors": {
              "terms": {
                "field": "monitor.host",
                "size": 100,
                "min_doc_count": 1
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "metadata": {
    "name": "Ping test systems",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2018-07-16T16:21:17.638Z",
    "execution_duration": 80,
    "input": {
      "type": "search",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "illegal_argument_exception",
            "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
          }
        ],
        "type": "search_phase_execution_exception",
        "reason": "all shards failed",
        "phase": "query",
        "grouped": true,
        "failed_shards": [
          {
            "shard": 0,
            "index": "heartbeat-6.3.0-2018.07.16",
            "node": "IFLmN_enSMy4r8OWPr-nzA",
            "reason": {
              "type": "illegal_argument_exception",
              "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
            }
          }
        ],
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat-*"
          ],
          "types": [],
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "must": [
                  {
                    "term": {
                      "monitor.status": {
                        "value": "down"
                      }
                    }
                  }
                ],
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "from": "now-15m"
                      }
                    }
                  }
                ]
              }
            },
            "aggregations": {
              "by_monitors": {
                "terms": {
                  "field": "monitor.host",
                  "size": 100,
                  "min_doc_count": 1
                }
              }
            }
          }
        }
      }
    },
    "actions": []
  },
  "messages": [
    "failed to execute watch input"
  ]
}

I ended up deleting the elasticsearch data folder again and re-creating visualizations, dashboards, and copy-pasting in the same watch again. For some reason it's working this time.

It looks as if the heartbeat index templates were not loaded correctly in the first try. Glad you got it working and thanks for coming back!

--Alex

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.