# Issue with Kibana sorting- Caused by: SearchParseException nested: IllegalStateException\[Field data loading is forbidden on severity\] **URL:** \ **Category:** Kibana\ **Created:** [February 27, 2018, 3:50pm UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688 "2018-02-27T15:50:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jenny8](https://avatars.discourse-cdn.com/v4/letter/j/e56c9b/32.png) [@jenny8](https://discuss.elastic.co/u/jenny8)\ **Post date:** [February 27, 2018, 3:50pm UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688/1 "2018-02-27T15:50:36Z")
Elasticsearch, Logstash and Kibana are running. kibana-4.3.1 elasticsearch-2.1.1 But failed to sort on any field from Kabana UI, for example, sort on field “severity”, got exception in elastic search.log. I read the whole thread [https://github.com/elastic/elasticsearch/issues/15267](https://github.com/elastic/elasticsearch/issues/15267), it said it is not a bug, it is by design,that kibana does not allow to sort on analyzed fields. But I still do not get idea how to fix my Kabana sorting issue? We should use severity.raw, which does exist in index pattern page, we can use severity.raw to create visualization, no problem. But severity.raw does not appear on Discover left panel, only severity. If I change the configuration of Available Fields with Analyzed=no, severity.raw is not in the list. [2018-02-26 17:06:27,748][DEBUG][action.search.type] [ACP10] All shards failed for phase: [query] RemoteTransportException[[ACP10][10.10.44.43:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"highlight":{"pre\_tags":["@kibana-highlighted-field@"],"post\_tags":["@/kibana-highlighted-field@"],"fields":{"_":{}},"require\_field\_match":false,"fragment\_size":2147483647},"query":{"filtered":{"query":{"query\_string":{"query":"type:AcpLog","analyze\_wildcard":true}},"filter":{"bool":{"must":[{"query":{"query\_string":{"query":"","analyze\_wildcard":true}}},{"range":{"@timestamp":{"gte":1361916387285,"lte":1519682787285,"format":"epoch\_millis"}}}],"must\_not":[]}}}},"size":500,"sort":[{"severity":{"order":"asc","unmapped\_type":"boolean"}}],"fields":["_","\_source"],"script\_fields":{},"fielddata\_fields":["@timestamp","arrivalTime"]}]]; nested: IllegalStateException[Field data loading is forbidden on severity]; Caused by: SearchParseException[failed to parse search source [{"highlight":{"pre\_tags":["@kibana-highlighted-field@"],"post\_tags":["@/kibana-highlighted-field@"],"fields":{"_":{}},"require\_field\_match":false,"fragment\_size":2147483647},"query":{"filtered":{"query":{"query\_string":{"query":"type:AcpLog","analyze\_wildcard":true}},"filter":{"bool":{"must":[{"query":{"query\_string":{"query":"","analyze\_wildcard":true}}},{"range":{"@timestamp":{"gte":1361916387285,"lte":1519682787285,"format":"epoch\_millis"}}}],"must\_not":[]}}}},"size":500,"sort":[{"severity":{"order":"asc","unmapped\_type":"boolean"}}],"fields":["_","\_source"],"script\_fields":{},"fielddata\_fields":["@timestamp","arrivalTime"]}]]; nested: IllegalStateException[Field data loading is forbidden on severity]; ---
**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\ **Post date:** [February 28, 2018, 6:33am UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688/2 "2018-02-28T06:33:53Z")
If you have `severity` and `severity.raw`, then it sounds like severity is mapped as `string`, but is a multi field that has a "raw" field for the non-analyzed representation. Here's the documentation on multi-field: [https://www.elastic.co/guide/en/elasticsearch/reference/2.1/multi-fields.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.1/multi-fields.html) You can change the mapping so `severity` becomes the "raw" and in the multi-field, the analyzed representation is `severity.analyzed`. ```auto PUT /my_index { "mappings": { "my_type": { "properties": { "severity": { "type": "string", "index": "not_analyzed", "fields": { "analyzed": { "type": "string" } } } } } } } ``` More to the point though, do you actually need `severity` to be a multi-field with an analyzed representation, or can `severity` just be mapped as `not_analyzed`? ```auto PUT /my_index { "mappings": { "my_type": { "properties": { "severity": { "type": "string", "index": "not_analyzed" } } } } } ``` ---
**Author:** ![jenny8](https://avatars.discourse-cdn.com/v4/letter/j/e56c9b/32.png) [@jenny8](https://discuss.elastic.co/u/jenny8)\ **Post date:** [March 19, 2018, 8:26pm UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688/3 "2018-03-19T20:26:38Z")
Tim, thanks for your reply. I got my index through API, it seems that severity is not defined as a mulit-field with analyzed. It is not\_analyzed instead. Why it can not be sorted? "severity":{"type":"string","norms":{"enabled":false},"fielddata":{"for mat":"disabled"},"fields":{"raw":{"type":"string","index":"not\_analyzed","ignore\_above":256}}} ---
**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\ **Post date:** [March 23, 2018, 7:54pm UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688/4 "2018-03-23T19:54:16Z")
Hi jenny8, Sorry for the delay in response, but 2.1 is pretty old and looking around in this kind of environment is a huge context switch. Based on the mapping you provided, your `severity` field looks like it is a multi-field, and if I reproduce a simple case of an index with only a field like that, it would be: ```auto PUT /my_index { "mappings": { "_default_": { "_timestamp": { "enabled": true } }, "doc": { "properties": { "severity": { "type": "string", "norms": { "enabled": false }, "fielddata": { "format": "disabled" }, "fields": { "raw": { "type": "string", "index": "not_analyzed", "ignore_above": 256 } } } } } } } ### POST /my_index/doc { "severity": "abc" } POST /my_index/doc { "severity": "bcd" } POST /my_index/doc { "severity": "zyx" } POST /my_index/doc { "severity": "srq" } POST /my_index/doc/_search { "sort": { "severity.raw": "asc" } } ``` The sort does correctly return the documents in the right order, but that's in pure ES, not Kibana. I noticed that when I tried to make this into an Index Pattern in Kibana, the Discover app wasn't able to sort the documents based on `severity`. I think that is because the `.raw` field isn't reflected in the `_source` and Kibana doesn't seem to be aware of it. But that field should be available as a `not_analyzed` field in visualizations. Just curious, but if there are barriers in the way of upgrading to a newer stack version, would you mind sharing what they are? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 20, 2018, 7:54pm UTC](https://discuss.elastic.co/t/issue-with-kibana-sorting-caused-by-searchparseexception-nested-illegalstateexception-field-data-loading-is-forbidden-on-severity/121688/5 "2018-04-20T19:54:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.