Uptime dashboard - Error: [illegal_argument_exception] Text fields are not optimised for operations that require per-document field data

Elastic Stack Beats
1

Hey Team. Just getting started using heartbeat.
Here's the full error I'm getting. This shows up under the 'Monitor Status' section of the /app/uptime area:

Error: [illegal_argument_exception] Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [monitor.id] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

heartbeat
heartbeat1880×703 58.4 KB

I cleared the index which is why it's only there once, but it was down there several times. Not sure what I did wrong :slight_smile:

I feel like I can work around this with my own dashboards but I want to understand what I did/didn't do, etc. And of course having access to the built-in dashboard won't hurt!

2

Hey, if you clear the index while heartbeat is still running, and with auto-creation of indexing enabled ES will guess the wrong mapping.

The good news is this is something we're working to improve in ES.

The better news is there's an easy fix for your local setup.

  1. Stop all running heartbeat instances
  2. Deletes all heartbeat indices
  3. Start heartbeat again
3

Beautiful, thank you! I'll give that a try later this morning

4

So bad news @Andrew_Cholakian1!

I stopped heartbeat (I just have the one), I deleted the indices, and I even deleted the kibana mapping.

Started heartbeat, made a new mapping in kibana.

Dashboard looks exactly the same! Same error:

Error: [illegal_argument_exception] Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [monitor.id] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

Any other thoughts? What did I miss?

5

Hmmm, what do you mean by "made a new mapping in kibana". Did you make one, or did heartbeat?

The mapping heartbeat makes shouldn't cause this issue.

Technically heartbeat makes a template, which is used to generate the mapping. That monitor.id is not a keyword type (which is indicated by the error you're getting), shows that the template isn't being created or applied.

6

Ah...that puts me down the right path, I hope. I definitely modified my default ES template what feels like a hundred years ago, because I was having trouble with winlogbeat needing more than 1000 fields. I wonder if I did something that messed things up for heartbeat. I think that's the door I need to kick down for now.

Because kibana definitely didn't have a mapping for heartbeat - I had to go in and create a "heartbeat-*" mapping manually.

More than likely I have gummed up the works :expressionless:

7

Ran into same issue. I fixed it by stopping Heartbeat, deleting the template, and restarting Heartbeat.

DELETE /_template/heartbeat-7.8.2

HTH,

--
Ross

2 Likes
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.