Why i am getting "1 of 3 shards failed"

[tbhaxor (Gurkirat Singh)]

Why i am getting this error.

RESPONSE

{
  "took": 27,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 2,
    "skipped": 0,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "packetbeat-7.6.1-2020.03.07",
        "node": "THJOod5tSUGcF23uhLuKfw",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [event.dataset] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "2": {
      "buckets": []
    }
  }
}

PS: This happened after fresh installation of packetbeat

[mtojek (Marcin Tojek)]

Hi tbhaxor,

The packetbeat installation might be fresh, but what about the cluster? Did you perform an update? see a similar thread: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index

[tbhaxor (Gurkirat Singh)]

I am using elasticsearch 7.4.2