Why i am getting "1 of 3 shards failed"

Elastic Stack Beats
1

Why i am getting this error.

image
image773×467 22.4 KB

RESPONSE

{
  "took": 27,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 2,
    "skipped": 0,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "packetbeat-7.6.1-2020.03.07",
        "node": "THJOod5tSUGcF23uhLuKfw",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [event.dataset] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "2": {
      "buckets": []
    }
  }
}

PS: This happened after fresh installation of packetbeat

2

Hi tbhaxor,

The packetbeat installation might be fresh, but what about the cluster? Did you perform an update? see a similar thread: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index

3

I am using elasticsearch 7.4.2

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.