Kibana error "fielddata is disabled by default on text fields"

Elastic Stack Elasticsearch
1

Hi,

Kibana gives me an error when I try to render a vizualisation : Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [bytes] in order to load fielddata in memory by bla bla bla...

The problem is: the field "bytes" is a long, not a text field. When I try to create a visualization with an sum of bytes as metric, this field is not visible in the select.

I pushed my mapping template, containing:

{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
		"referrer": {
          "type": "string",
          "index": "analyzed"
        },
		"agent": {
          "type": "string",
          "index": "analyzed"
        },
		"clientip": {
          "type": "ip"
        },
		"ident": {
          "type": "string",
          "index": "analyzed"
        },
		"auth": {
          "type": "string",
          "index": "analyzed"
        },
		"referrer": {
          "type": "string",
          "index": "analyzed"
        },
		"verb": {
          "type": "string",
          "index": "analyzed"
        },
		"referrer": {
          "type": "string",
          "index": "analyzed"
        },
		"request": {
          "type": "string",
          "index": "analyzed"
        },
		"httpversion": {
          "type": "float",
          "doc_values": "true"
        },
		"response": {
          "type": "long",
          "doc_values": "true"
        },
		"bytes": {
          "type": "long",
          "doc_values": "true"
        },
		"class": {
          "type": "string",
          "index": "analyzed"
        },
		"request": {
          "type": "string",
          "index": "analyzed"
        },
		"request": {
          "type": "level",
          "index": "analyzed"
        },
		"content": {
          "type": "string",
          "index": "analyzed"
        },
		"errNumber": {
          "type": "long",
          "doc_values": "true"
        },
		"session": {
          "type": "string",
          "index": "analyzed"
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "indice-*"
}

Weird problem: kibana shows a string (analyzed and indexed) for this fields (into settings / template fields).

My software versions are:

  • elasticsearch 5 alpha 3
  • kibana 5 alpha 3

My stack is filebeat alpha 4 -> redis -> logstash alpha 4 -> elasticsearch alpha 3.

Any idea?

Thanks

2

Can you check the mappings of the bytes field on all indices in the cluster?

3

Here is an extract of the mapping of the bytes field on one indice:

bytes: {
  type: "text",
  fields: {
    keywork: {
      type: "keyword",
      ignore_above: 256
    }
  }
}

I don't understand why my template mapping is not applied...

Here is the full mapping: http://pastebin.com/Hi66Vsm3

4

Problem solved...

I just based my template on the filebeat/template-es2x.json file :slight_smile:

5

Hi , @jpountz @marminthibaut @zikakou1er @fcza
I run into the same problem now , here is part of my template :
"short_name": {
"index": "not_analyzed",
"type": "keyword",
"doc_values": true
},
"country_id": {
"index": "not_analyzed",
"type": "string",
"doc_values": true
},
"city_id": {
"type": "integer",
"doc_values": true
}

and I got error when I upgrade ES from V 2.1 to V 5.0.0 , how can I solve this problem considering I have so much data with V 2.1:
error MSG :
"reason": {
"type": "illegal_argument_exception",
"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [short_name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."
}

6

Have you found a solution? I'm having the same with normal filebeat.

1 Like
7

How to set filedata = true to fix this error?