Illegal_argument_exception when opening dashboard

[yelloyonder (Jon Dodds)]

For ref we're using Elastic Cloud.

When opening a particular dashboard we see a shard failure. The error reason is:

Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [log.level] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

There are a couple of things that I don't fully understand

1. The shard error references an Index that isn't used by the Dashboard, so why is it complaining? I have dashboards that do use the index referenced and they work fine.
2. If I check the mapping type for log.level in the referenced index:

  "log": {
          "properties": {
            "level": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword"
                }

It is type text but also has a keyword, so looks like there shouldn't be an issue?

Any tips would be greatly appreciated. I could change the type to 'keyword' but just wanted to understand why this is happening.

[warkolm (Mark Walkom)]

You need to be using log.level.keyword in instances like this, as fields mapped as a keyword are best for aggregations.

[yelloyonder (Jon Dodds)]

Hi Mark, Thanks for the info, somehow I missed your comment. I created a new dashboard and the issue no longer occurs.

Cheers,
Jon