Mapping error: Please use a keyword field instead

Elastic Stack Elasticsearch
1

Hi, Im getting data from Azure with metricbeat, and also getting additional data from event hub.

the data from metricbeat and Event Hub is shown in the same dashboard.

In order to filter with a control visualization in a dashboard with data from both sources, I added a field in common with metricbeat mapping called: azure.resource.name, and called the indices with data from Event Hub: metricbeat-client-name%{+YYYY.MM} so they are included in the index pattern: metricbeat-*

But every time I load the dashboard i got the this error: 13 of 17 shards failed The data you are seeing might be incomplete or wrong.

Error reason:
Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [azure.resource.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

All those 13 shards that fail are the ones with data from event hub named like this:

example:
metricbeat-client-name1
metricbeat-client-name2
metricbeat-client-name3

And when I get the mapping for that field from all those individual indices I get this:

{
  "metricbeat-client-name1-2022.03" : {
    "mappings" : {
      "azure.resource.name" : {
        "full_name" : "azure.resource.name",
        "mapping" : {
          "name" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      }
    }
  }

So what can I do to solve those errors?

2

Try using azure.resource.name.keyword instead?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.