Kibana sending "docvalue_fields" that break ES?

Elastic Stack Kibana
1

I've been using ES and Kibana for quite a while now, but this morning ES started failing with "Courier Fetch: 5 of 5 shards failed". I started digging into this, and there's nothing in the logs, but if I query older records everything works fine. If I query recent records, looking at the request actually going from Kibana I see:

{
    "size": 500,
    "sort": [{"@timestamp": {"order": "desc", "unmapped_type": "boolean"}}],
    "query": {...},
    "highlight": {...},
    "_source": {"excludes": []},
    "aggs": {...},
    "stored_fields": ["*"],
    "script_fields": {},
    "docvalue_fields": [
        ...
        "data.schedule",
        ...
    ]
}

And then in the reply:

"reason":{
    "type":"illegal_argument_exception",
    "reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [data.schedule] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."
}

Wat? Why is Kibana sending "data.schedule" in "docvalue_fields"? And why is this suddenly breaking now? Kibana/ES version is 5.1.1.

2

Ok, I know why it's failing now and not before - it's because this 'schedule' field is one that gets logged by an obscure error. But why is Kibana sending data.schedule in docvalue_fields, and is there a way to stop it?

3

@jwalton if you look at your Index Pattern in Kibana, what do you see in the "type" column for the "data.schedule" field? Kibana is automatically requesting docvalue_fields for fields with type 'date'.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.