Kibana shows Shard Failures

Elastic Stack Elasticsearch
1

HI Greetings,

Can you please help to fix below kibana error,

Shard Failures

Index: weblogs-2015.12.07 Shard: 0 Reason: ElasticsearchException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [@timestamp] would be larger than limit of [6431991398/5.9gb]]; nested: UncheckedExecutionException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [@timestamp] would be larger than limit of [6431991398/5.9gb]]; nested: CircuitBreakingException[[FIELDDATA] Data too large, data for [@timestamp] would be larger than limit of [6431991398/5.9gb]];

2

I think this is an elasticsearch issue, not a kibana issue. Kibana is just showing you the error that came from elasticsearch. I'm not sure how to move this to the elasticsearch discuss topic or if you would start another discussion there.

3

Yes, I have moved to Elastic search.

4

Yep it's an ES issue, it means your query would have caused an OOM and so it was stopped.

In this case you need to either add more heap to your/add more nodes, reduce the timeframe of the query or reindex everything set as not_analyzed to doc values.

5

could you please let me know how to configure this "everything set as not_analyzed to doc values".

6

Have a look at https://www.elastic.co/guide/en/elasticsearch/reference/2.3/doc-values.html

7

I used the multi_field type so that i can have the raw data which is not_analyzed and another one that is analyzed and can be search.