# Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on \[apache2.access.remote\_ip\] in order to load fielddata in memory

**URL:** https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706
**Category:** Kibana
**Created:** [August 16, 2018, 11:40am UTC](https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706 "2018-08-16T11:40:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Satish\_Chhatpar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/satish_chhatpar/32/34473_2.png) [@Satish\_Chhatpar](https://discuss.elastic.co/u/Satish_Chhatpar)
#### Post date: [August 16, 2018, 11:40am UTC](https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706/1 "2018-08-16T11:40:11Z")

</div>

Please help me to fix this error.

 ![%245CE47690B71E21D5](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02b28e3d11fce2c45364d12048bb8b3789daff53.jpeg)

versions used  
filebeat version 6.3.2  
logstash version 6.3.2  
elasticsearch version 6.3.2  
kibana version 6.3.2

Apache log format is  
LogFormat ""%{True-Client-IP}i" %t %\>s %b "%r" "%{Referer}i" "%{X-Forwarded-For}i" "%{User-Agent}i" "%{X-JSESSIONID}o" %u %q %T/%D %h" custom

filebeat.yml

filebeat.inputs:

- paths:
  - /path/to/logs/access\*  
tags: [apache\_access]

output.logstash:  
hosts: ["127.0.0.1:5044"]  
setup.kibana:  
host: "[http://127.0.0.1:5601](http://127.0.0.1:5601)"

logstash config

input {  
beats {  
port =\> 5044  
}  
}

filter {  
if "apache\_access" in [tags] {  
grok {  
# You'll need to customize the pattern for your log format.  
match =\> { "message" =\> [  
""%{IPORHOST:apache2.access.client\_ip}" [%{HTTPDATE:apache2.access.time}] %{NUMBER:apache2.access.response\_code} %{NUMBER:apache2.access.body\_sent.bytes} "%{WORD:apache2.access.method} %{DATA:apache2.access.url} HTTP/%{NUMBER:apache2.access.http\_version}" "%{DATA:apache2.access.rawrequest}" "%{DATA:apache2.access.referrer}" "%{DATA:apache2.access.agent}" "%{DATA:apache2.access.jsessionid}" - %{DATA:apache2.access.extra} %{NUMBER:apache2.access.seconds}/%{NUMBER:apache2.access.microseconds} %{IPORHOST:apache2.access.remote\_ip}",  
""%{IPORHOST:apache2.access.client\_ip}" [%{HTTPDATE:apache2.access.time}] %{NUMBER:apache2.access.response\_code} - "%{WORD:apache2.access.method} %{DATA:apache2.access.url} HTTP/%{NUMBER:apache2.access.http\_version}" "%{DATA:apache2.access.rawrequest}" "%{DATA:apache2.access.referrer}" "%{DATA:apache2.access.agent}" "%{DATA:apache2.access.jsessionid}" - %{NUMBER:apache2.access.seconds}/%{NUMBER:apache2.access.microseconds} %{IPORHOST:apache2.access.remote\_ip}",  
""%{IPORHOST:apache2.access.client\_ip}" [%{HTTPDATE:apache2.access.time}] %{NUMBER:apache2.access.response\_code} %{NUMBER:bytes} "%{WORD:apache2.access.method} %{DATA:apache2.access.url} HTTP/%{NUMBER:apache2.access.http\_version}" "%{DATA:apache2.access.rawrequest}" "%{DATA:apache2.access.referrer}" "%{DATA:apache2.access.agent}" "%{DATA:apache2.access.jsessionid}" - %{NUMBER:apache2.access.seconds}/%{NUMBER:apache2.access.microseconds} %{IPORHOST:apache2.access.remote\_ip}"  
]  
}  
}  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

I am OK to do screen share. I am available from 1:30 PM IST to 9:30 PM IST

Thanks  
Satish

---

<div class="post-metadata">

### Author: ![a5a](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@a5a](https://discuss.elastic.co/u/a5a)
#### Post date: [August 16, 2018, 4:13pm UTC](https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706/2 "2018-08-16T16:13:34Z")

</div>

Your mappings are not properly set up. If you want to use fielddata on text fields, you set fielddata=true for those fields. See [https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html)

---

<div class="post-metadata">

### Author: ![Satish\_Chhatpar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/satish_chhatpar/32/34473_2.png) [@Satish\_Chhatpar](https://discuss.elastic.co/u/Satish_Chhatpar)
#### Post date: [August 23, 2018, 6:30am UTC](https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706/3 "2018-08-23T06:30:33Z")

</div>

Archana how do I set fielddata = true ? What is the procedure ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2018, 6:30am UTC](https://discuss.elastic.co/t/visualize-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-apache2-access-remote-ip-in-order-to-load-fielddata-in-memory/144706/4 "2018-09-20T06:30:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.