Heartbeat monitor.status watch giving "Fielddata is disabled on text fields by default."

alerting

#1

I had to remove my elasticsearch data folder to get by a Kibana issue that's not allowing me to get back into the Watches management section.

After getting back into the Watches management section, I copy-pasted in the JSON for the watch I had been using for Heartbeat ping status, but when I try to simulate or execute the watch now I'm getting the following failure:

"Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."

I wasn't getting this problem before with the same watch. What could the problem be?

{
  "watch_id": "_inlined_",
  "node": "IFLmN_enSMy4r8OWPr-nzA",
  "state": "failed",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2018-07-16T16:21:17.625Z"
    },
    "actions": {
      "send_email": {
        "ack": {
          "timestamp": "2018-07-16T16:21:17.625Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "failed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2018-07-16T16:21:17.631Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2018-07-16T16:21:17.631Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "monitor.status": {
                      "value": "down"
                    }
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-15m"
                    }
                  }
                }
              ]
            }
          },
          "aggregations": {
            "by_monitors": {
              "terms": {
                "field": "monitor.host",
                "size": 100,
                "min_doc_count": 1
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "metadata": {
    "name": "Ping test systems",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2018-07-16T16:21:17.638Z",
    "execution_duration": 80,
    "input": {
      "type": "search",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "illegal_argument_exception",
            "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
          }
        ],
        "type": "search_phase_execution_exception",
        "reason": "all shards failed",
        "phase": "query",
        "grouped": true,
        "failed_shards": [
          {
            "shard": 0,
            "index": "heartbeat-6.3.0-2018.07.16",
            "node": "IFLmN_enSMy4r8OWPr-nzA",
            "reason": {
              "type": "illegal_argument_exception",
              "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
            }
          }
        ],
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [monitor.host] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat-*"
          ],
          "types": [],
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "must": [
                  {
                    "term": {
                      "monitor.status": {
                        "value": "down"
                      }
                    }
                  }
                ],
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "from": "now-15m"
                      }
                    }
                  }
                ]
              }
            },
            "aggregations": {
              "by_monitors": {
                "terms": {
                  "field": "monitor.host",
                  "size": 100,
                  "min_doc_count": 1
                }
              }
            }
          }
        }
      }
    },
    "actions": []
  },
  "messages": [
    "failed to execute watch input"
  ]
}

#2

I ended up deleting the elasticsearch data folder again and re-creating visualizations, dashboards, and copy-pasting in the same watch again. For some reason it's working this time.


(Alexander Reelsen) #3

It looks as if the heartbeat index templates were not loaded correctly in the first try. Glad you got it working and thanks for coming back!

--Alex


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.