[Solved] Cannot visualise field with analyzed strings in kibana 4.3

Elastic Stack Kibana
1

Hi Guys

I am having a problem with vizualization of any "analyzed" field in Kibana 4.3.0 on one of my servers. Whenever I try to build any vizualization (say piechart, or anything else) based on any non-raw field I get the next error message:

Visualize: java.lang.IllegalStateException: Field data loading is forbidden on FIELDNAME

[quote]Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"exception","reason":"java.lang.IllegalStateException: Field data loading is forbidden on file"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-2015.12.07","node":"C8TZLPH_Q7GYQzCLi8_HuA","reason":{"type":"exception","reason":"java.lang.IllegalStateException: Field data loading is forbidden on file","caused_by":{"type":"unchecked_execution_exception","reason":"java.lang.IllegalStateException: Field data loading is forbidden on file","caused_by":{"type":"illegal_state_exception","reason":"Field data loading is forbidden on file"}}}}]}}
KbnError@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:58153:21
RequestFailure@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:58186:1
callResponseHandlers/<@http://dev-cres-db-s2-2.vega.ironport.com/bundles/kibana.bundle.js:78760:39
WEBPACK_AMD_DEFINE_RESULT</</Promise.try@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:60967:20
WEBPACK_AMD_DEFINE_RESULT</</Promise.map/<@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:60936:17
WEBPACK_AMD_DEFINE_RESULT</</Promise.map@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:60935:27
callResponseHandlers@http://dev-cres-db-s2-2.vega.ironport.com/bundles/kibana.bundle.js:78732:1
fetchWithStrategy/<@http://dev-cres-db-s2-2.vega.ironport.com/bundles/kibana.bundle.js:78239:17
processQueue@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:42339:29
scheduleProcessQueue/<@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:42355:28
$RootScopeProvider/this.$get</Scope.prototype.$eval@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:43583:17
$RootScopeProvider/this.$get</Scope.prototype.$digest@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:43394:16
$RootScopeProvider/this.$get</Scope.prototype.$apply@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:43691:14
done@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:38140:37
completeRequest@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:38338:8
requestLoaded@http://dev-cres-db-s2-2.vega.ironport.com/bundles/commons.bundle.js:38279:1
[/quote]

I have another server running the same versions of kibana/elasticsearch/logstash which works just fine, the sad thing that the one which works fine is my testing one and the problem one should have become prod :slight_smile:
I use kibana 4.3 and elasticsearch 2.1.0
The only difference (except servers' hardware) is that the working one uses JDK8u40 when non-working is on u65.

Thank you for any info.
Andrii.

2

So I tried to use the same build of java on both servers - it didn't solve the problem.
I have also tried to copy kibana folder from the working one to none working with no luck as well.
I also reinstalled elasticsearch and removed and re-created it's lib directory with same no results.

3

So I was able to fix the issue by simply moving /var/lib/elasticsearch from the working one to the non-working. Lost all data but at least I have a working index now.

1 Like