Kibana is throwing error for Transaction Event field status

" Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [status] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field …"

I am pumping data from Packetbeat->Logstash->Elastic->Kibana

Do I need to modify the fields.yml in Packetbeat for this.

we learned that we need to need to modify the elastic with fieldadata as true , but this is not
solving our problem.

It sounds like maybe the index template wasn't loaded prior to the data being ingested, which lead to the wrong mapping types being inferred.

I would recommend first running the setup command from the CLI prior to ingesting data.

Thanks for quick response.

Yes , we missed this , we will correct this.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.