# Shards Failed on geoip
**URL:** https://discuss.elastic.co/t/shards-failed-on-geoip/220050
**Category:** Kibana
**Created:** [February 19, 2020, 6:56pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050 "2020-02-19T18:56:48Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@fastxl](https://discuss.elastic.co/u/fastxl)
#### Post date: [February 19, 2020, 6:56pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/1 "2020-02-19T18:56:48Z")
Have had ELK up and running now for a few days. All was working just fine. Today however and am getting the attached error and data isn't showing up in 2 panels.
When I try to click on Show Details it's a dead link. How can I trouble shoot this?
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [February 19, 2020, 7:00pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/2 "2020-02-19T19:00:10Z")
You may be able to use the Kibana inspector or the Network tab of the browser developer tools to capture the request that is causing problems.
---
### Author:  [@fastxl](https://discuss.elastic.co/u/fastxl)
#### Post date: [February 19, 2020, 8:35pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/3 "2020-02-19T20:35:06Z")
When doing some Inspecting I see this error
> "java.util.concurrent.ExecutionException: CircuitBreakingException[[fielddata] Data too large, data for [\_id] would be [420863022/401.3mb], which is larger than the limit of [415550668/396.2mb]]",
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [February 19, 2020, 8:46pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/4 "2020-02-19T20:46:57Z")
Okay, this is a common issue when aggregating on `_id`. Take a look at this: [https://github.com/elastic/elasticsearch/issues/43599](https://github.com/elastic/elasticsearch/issues/43599)
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [February 19, 2020, 8:53pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/5 "2020-02-19T20:53:34Z")
We also recommend against aggregating on the `_id` field in general [https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html)
---
### Author:  [@fastxl](https://discuss.elastic.co/u/fastxl)
#### Post date: [February 20, 2020, 12:41pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/6 "2020-02-20T12:41:35Z")
Thanks for the direction. I am a bit new at this and not quite sure how to handle fixing it. How would I duplicate the \_id field to another?
```
{
"aggs": {
"2": {
"terms": {
"field": "geoip.country_name.keyword",
"order": {
"1": "desc"
},
"size": 5
},
"aggs": {
"1": {
"cardinality": {
"field": "_id"
}
}
}
}
},
```
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [February 20, 2020, 2:28pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/7 "2020-02-20T14:28:32Z")
You can't do this in your query, you would need to change your mapping. Unfortunately I don't know how to set this up, but my guess is that it involves the copy\_to parameter: [https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2020, 2:40pm UTC](https://discuss.elastic.co/t/shards-failed-on-geoip/220050/8 "2020-03-19T14:40:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.