1. Describe your incident:
I do have some problem when I check the log from graylog-server, there’s the error I have :
2023-03-10T14:44:32.506-05:00 ERROR [PivotAggregationSearch] Aggregation search query returned an error: OpenSearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].
2. Describe your environment:
Oracle Linux 7
Graylog 5.0.5 Entreprise
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
I tried to update my field message with API for fielddata=true and still having the error.
4. How can the community help?
I do not know how to remediate this situation.
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]