# \[illegal\_argument\_exception\] Fielddata is disabled on text fields by default. Set fielddata=true on \[host.name\]

**URL:** https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-host-name/235596
**Category:** Elasticsearch
**Created:** [June 3, 2020, 3:49pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-host-name/235596 "2020-06-03T15:49:42Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Boomania](https://avatars.discourse-cdn.com/v4/letter/b/b782af/32.png) [@Boomania](https://discuss.elastic.co/u/Boomania)
#### Post date: [June 3, 2020, 3:49pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-host-name/235596/1 "2020-06-03T15:49:42Z")

</div>

Hi everyone,

I am stuck with an issue regarding fielddata aggregation. I spent many days looking for similar issues, but none of them worked.

In a nutshell, I use ELK stack (version 7.3.1) for personal purpose and want to exploit Dashboard & SIEM utilities.

My architecture is the following (all based on Linux OS):  
**[subnet 1 : various beats on every available machines a own -\> kafka]** -\> Personnal Routeur -\> **[Subnet 2 : Logstash -\> Elasticsearch \<- Kibana]**

I configured Xpack free functionalities for encryption/Keystores... and I managed to centralize the logs on the Elasticsearch. Then on Kibana interface I created index paterns based on indexes available on the index management page. _I used logstash to parse the logs that are not already parsed by default. When I go to the Discover page, everything runs fine. I have all my indexes, and I can search using advanced filters._

The problem is : I have issues when I want to use the SIEM app, only the main overview counts Hosts Events & Network Events. When I click on one of them, nothing displays and I have the following error : **[illegal\_argument\_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [host.name]**

As I understand, Logstash has something that alters data type. I firstly checked my Logstash file configuration. Here is the end of it :

```auto
       output {
    	elasticsearch {
    		hosts => "localhost:9200"
    		**manage_template => "false"**
    		index => "%{[@metadata][kafka][lc_topic]}-%{+YYYY.MM.dd}"
    		user => "${ES_USER}"
    		password => "${ES_PWD}"
    	}
    }

```

I though it was because I didn't correctly uploaded / install the beats templates. So I did it again, following those steps :

1. I deleted all indexes with the Kibana interface
2. On each machine : `< beat_name> export template > <beat_name>.template.json`
3. Checked they were populated, and uploaded them on the ELK server (scp)
4. Used the command ```curl -XPUT -H 'Content-Type: application/json'  
[http://localhost:9200/\_template/](http://localhost:9200/_template/)\<beat\_name-version\> -d@\<beat\_name\>.template.json

```auto
5) As the issue was not resolved, I restarted ELK services. No improvement.

I hope I was clear, feel free to ask any further technical information.

Thank you in advance for your help.
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 1, 2020, 3:49pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-host-name/235596/2 "2020-07-01T15:49:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.