# New Stack new problems - illegal\_argument\_exeption

**URL:** <https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341>\
**Category:** Elasticsearch\
**Created:** [December 17, 2021, 5:00pm UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341 "2021-12-17T17:00:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Orpheus](https://avatars.discourse-cdn.com/v4/letter/o/e36b37/32.png) [@Orpheus](https://discuss.elastic.co/u/Orpheus)\
**Post date:** [December 17, 2021, 5:00pm UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341/1 "2021-12-17T17:00:45Z")

</div>

Hi, so due to a previous post's issues, I created a new ELK stack on a new machine. Completely re-installed the OS and recreated ELK with filebeats. After the installation and configurations, I get a new error saying

"1 of 2 shards failed

The data you are seeing might be incomplete or wrong."

further detail of the error says this:

```auto
{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 2,
    "successful": 1,
    "skipped": 1,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "filebeat-2021.12.17",
        "node": "ZmqIIkQOSYiEN2QaQXpvJQ",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.hostname] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": 0,
    "hits": []
  }
}

```

-Four of these errors pop up under the syslog dashboard of the system module.  
-The only thing I have implemented was the system module, which I understood to be prepackaged, and the first time I tried doing this it showed up with no issues.

Now, I believe I only have one shard, so why would it be trying to access two?  
And where could the issue lie preventing me from getting accurate log data? I have already taken two steps backwards, when my ultimate goal is to get Mikrotik syslogging functioning, but I am struggling just getting the regular server data to work properly now.

Thanks for any help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 20, 2021, 1:19am UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341/2 "2021-12-20T01:19:11Z")

</div>

What version did you install?

---

<div class="post-metadata">

**Author:** ![Orpheus](https://avatars.discourse-cdn.com/v4/letter/o/e36b37/32.png) [@Orpheus](https://discuss.elastic.co/u/Orpheus)\
**Post date:** [December 20, 2021, 2:17pm UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341/3 "2021-12-20T14:17:37Z")

</div>

Hi Mark,

thank you for the response. The version that I just installed is 7.16.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2022, 2:18pm UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341/4 "2022-01-17T14:18:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.