For ref we're using Elastic Cloud.
When opening a particular dashboard we see a shard failure. The error reason is:
Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [log.level] in order to load field data by uninverting the inverted index. Note that this can use significant memory.
There are a couple of things that I don't fully understand
- The shard error references an Index that isn't used by the Dashboard, so why is it complaining? I have dashboards that do use the index referenced and they work fine.
- If I check the mapping type for
log.level
in the referenced index:
"log": {
"properties": {
"level": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
It is type text but also has a keyword, so looks like there shouldn't be an issue?
Any tips would be greatly appreciated. I could change the type to 'keyword' but just wanted to understand why this is happening.