# Error about message field **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 10, 2023, 7:47pm UTC](https://community.graylog.org/t/error-about-message-field/28056 "2023-03-10T19:47:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![MickGraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mickgraylog1/32/13153_2.png) [@MickGraylog1](https://community.graylog.org/u/MickGraylog1)\ **Post date:** [March 10, 2023, 7:47pm UTC](https://community.graylog.org/t/error-about-message-field/28056/1 "2023-03-10T19:47:55Z")
Hello **1. Describe your incident:** I do have some problem when I check the log from graylog-server, there’s the error I have : 2023-03-10T14:44:32.506-05:00 ERROR [PivotAggregationSearch] Aggregation search query returned an error: OpenSearch exception [type=illegal\_argument\_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.]. **2. Describe your environment:** - OS Information: Oracle Linux 7 - Package Version: Graylog 5.0.5 Entreprise - Service logs, configurations, and environment variables: **3. What steps have you already taken to try and solve the problem?** I tried to update my field message with API for fielddata=true and still having the error. **4. How can the community help?** I do not know how to remediate this situation. Thank you **Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab] ---
**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\ **Post date:** [March 10, 2023, 9:14pm UTC](https://community.graylog.org/t/error-about-message-field/28056/2 "2023-03-10T21:14:52Z")
You can’t make dashboards out of the message or the full\_message fields. “Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead.” You need to parse the messages and then make dashboards from those parsed fields. ---
**Author:** ![MickGraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mickgraylog1/32/13153_2.png) [@MickGraylog1](https://community.graylog.org/u/MickGraylog1)\ **Post date:** [March 10, 2023, 9:39pm UTC](https://community.graylog.org/t/error-about-message-field/28056/3 "2023-03-10T21:39:01Z")
Hello Chris, Thank for you reply. Funny thing, I do not have any dashboard has been created in my environment. ---
**Author:** ![MickGraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mickgraylog1/32/13153_2.png) [@MickGraylog1](https://community.graylog.org/u/MickGraylog1)\ **Post date:** [March 13, 2023, 1:55pm UTC](https://community.graylog.org/t/error-about-message-field/28056/4 "2023-03-13T13:55:35Z")
I just passed recently Elasticsearch to Opensearch, maybe it caused the problem? ---
**Author:** ![MickGraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mickgraylog1/32/13153_2.png) [@MickGraylog1](https://community.graylog.org/u/MickGraylog1)\ **Post date:** [March 20, 2023, 6:06pm UTC](https://community.graylog.org/t/error-about-message-field/28056/5 "2023-03-20T18:06:07Z")
Still having the error, I tried to change into the API “message”: { “type”: “keyword” }, Or I added fielddata=true and I still got the error message. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 20, 2023, 9:54pm UTC](https://community.graylog.org/t/error-about-message-field/28056/6 "2023-03-20T21:54:12Z")
Hey @MickGraylog1 > [@MickGraylog1](#): > > , I do not have any dashboard has been created in my environment. How about saved searchs? Somewhere on your device there is a field that has a texted search. You could try rotating the index set manually see if that clears it up. ---
**Author:** ![MickGraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mickgraylog1/32/13153_2.png) [@MickGraylog1](https://community.graylog.org/u/MickGraylog1)\ **Post date:** [March 21, 2023, 6:10pm UTC](https://community.graylog.org/t/error-about-message-field/28056/7 "2023-03-21T18:10:11Z")
Thank you so much @gsmith . You saved me! 🙂 Have a great day ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 4, 2023, 6:11pm UTC](https://community.graylog.org/t/error-about-message-field/28056/8 "2023-04-04T18:11:03Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.