Error about message field

Graylog Central (peer support)
1

Hello

1. Describe your incident:
I do have some problem when I check the log from graylog-server, there’s the error I have :

2023-03-10T14:44:32.506-05:00 ERROR [PivotAggregationSearch] Aggregation search query returned an error: OpenSearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

2. Describe your environment:

  • OS Information:
    Oracle Linux 7

  • Package Version:
    Graylog 5.0.5 Entreprise

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

I tried to update my field message with API for fielddata=true and still having the error.

4. How can the community help?

I do not know how to remediate this situation.

Thank you

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

You can’t make dashboards out of the message or the full_message fields.

“Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead.”

You need to parse the messages and then make dashboards from those parsed fields.

3

Hello Chris,

Thank for you reply. Funny thing, I do not have any dashboard has been created in my environment.

4

I just passed recently Elasticsearch to Opensearch, maybe it caused the problem?

5

Still having the error, I tried to change into the API
“message”: {
“type”: “keyword”
},

Or I added fielddata=true and I still got the error message.

6

Hey @MickGraylog1

How about saved searchs?
Somewhere on your device there is a field that has a texted search. You could try rotating the index set manually see if that clears it up.

1 Like
7

Thank you so much @gsmith . You saved me! :slight_smile:

Have a great day

2 Likes
8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.