Shards fail in high amount on certain Index

Elastic Stack Kibana
1

Hi guys,

when i take a look at one of my dashboards, which uses the Auditbeat-Index as an Input, i get an "20/24 Shards failed" Error like 20 Times on the side of my screen. It's stated as an illegal_arguement_expression with the following Message:

Type
illegal_argument_exception
Reason
Fielddata is disabled on text fields by default. Set fielddata=true on [user.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

So i don't really know what exactly i'm supposed to do here, and where to do it. Any hellp will be appreciated.

Cheers,
Mo

2

Hi, it looks like your Auditbeat index has data where user.name is mapped as a text field. I am guessing it should be mapped as a keyword (as the error messages says) so that you can make aggregate searches on that field.

It could mean there is a mapping conflict in Elasticsearch, or the mapping template for the Auditbeat index was accidentally deleted. You'll need to restore the mappings so that new Auditbeat indices have the data mapped correctly, but also reindex the existing data so the user.name fields are re-mapped as keyword.

3

Ok, thanks tsullivan, will try today.
Thanks in advance.