/var/log/elasticsearch/elasticsearch.log:
https://drive.google.com/file/...
...Shows the error (Failed to parse query [cat/indices?v]) over and over until EOF (seems to be an error resulting from the command you had me run in my other thread).
/var/log/elasticsearch/elasticsearch-2019-02-02-1.log:
https://drive.google.com/file/...
...Errors seem to be (java.lang.IllegalArgumentExcepction):
[2019-02-02T03:41:35,196][DEBUG][o.e.a.s.TransportSearchAction] [8dMqAA8] [metricbeat-2019.01.31][0], node[8dMqAA81SnCjXVDoTOAYnA], [P], s[STARTED], a[id=SQ_pHQHMSVCQLK_R7wmKPg]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[metricbeat-*], indicesOptions=IndicesOptions[ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false, ignore_throttled=true], types=[], routing='null', preference='null', requestCache=null, scroll=null, maxConcurrentShardRequests=5, batchedReduceSize=512, preFilterShardSize=42, allowPartialSearchResults=true, source={"size":0,"timeout":"90s","query":{"bool":{"must":[{"range":{"@timestamp":{"from":1548992494872,"to":1549078894872,"include_lower":true,"include_upper":true,"format":"epoch_millis","boost":1.0}}},{"bool":{"must":[{"query_string":{"query":"*","default_field":"*","fields":[],"type":"best_fields","default_operator":"or","max_determinized_states":10000,"enable_position_increments":true,"fuzziness":"AUTO","fuzzy_prefix_length":0,"fuzzy_max_expansions":50,"phrase_slop":0,"analyze_wildcard":true,"escape":false,"auto_generate_synonyms_phrase_query":true,"fuzzy_transpositions":true,"boost":1.0}}],"adjust_pure_negative":true,"boost":1.0}},{"query_string":{"query":"-system.network.name:l*","fields":[],"type":"best_fields","default_operator":"or","max_determinized_states":10000,"enable_position_increments":true,"fuzziness":"AUTO","fuzzy_prefix_length":0,"fuzzy_max_expansions":50,"phrase_slop":0,"analyze_wildcard":true,"escape":false,"auto_generate_synonyms_phrase_query":true,"fuzzy_transpositions":true,"boost":1.0}}],"adjust_pure_negative":true,"boost":1.0}},"aggregations":{"0c761591-1b92-11e7-bec4-a5e9ec5cab8b":{"meta":{"timeField":"@timestamp","intervalString":"600s","bucketSize":600},"terms":{"field":"system.network.name","size":10,"min_doc_count":1,"shard_min_doc_count":0,"show_term_doc_count_error":false,"order":[{"_count":"desc"},{"_key":"asc"}]},"aggregations":{"timeseries":{"date_histogram":{"field":"@timestamp","time_zone":"America/Denver","interval":"600s","offset":0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":0,"extended_bounds":{"min":1548992494872,"max":1549078894872}},"aggregations":{"0c761592-1b92-11e7-bec4-a5e9ec5cab8b":{"max":{"field":"system.network.in.bytes"}},"1d659060-1b92-11e7-bec4-a5e9ec5cab8b":{"derivative":{"buckets_path":["0c761592-1b92-11e7-bec4-a5e9ec5cab8b"],"gap_policy":"skip","unit":"1s"}},"f2074f70-1b92-11e7-a416-41f5ccdba2e6":{"bucket_script":{"buckets_path":{"value":"1d659060-1b92-11e7-bec4-a5e9ec5cab8b[normalized_value]"},"script":{"source":"params.value > 0.0 ? params.value : 0.0","lang":"painless"},"gap_policy":"skip"}}}}}}}}}] lastShard [true]
org.elasticsearch.transport.RemoteTransportException: [8dMqAA8][10.128.0.2:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [system.network.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.