# Error create Quick Values

**URL:** <https://community.graylog.org/t/error-create-quick-values/12516>\
**Category:** Graylog Central (peer support)\
**Created:** [October 25, 2019, 3:57pm UTC](https://community.graylog.org/t/error-create-quick-values/12516 "2019-10-25T15:57:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![juliomolonabreu](https://avatars.discourse-cdn.com/v4/letter/j/3e96dc/32.png) [@juliomolonabreu](https://community.graylog.org/u/juliomolonabreu)\
**Post date:** [October 25, 2019, 3:57pm UTC](https://community.graylog.org/t/error-create-quick-values/12516/1 "2019-10-25T15:57:35Z")

</div>

Hi, I’ to create Quick Values at to Graylog server at event arch at to graylog server log.

and  
Message error in http when click in Quick Values

Could not load quick values  
Loading quick values failed with status: Error cannot GET [http://10.0.20.40:12900/search/universal/relative/terms?query=\*&range=300&field=message&order=message%3Adesc&desc&size=50&stacked\_fields=](http://10.0.20.40:12900/search/universal/relative/terms?query=%2A&range=300&field=message&order=message%3Adesc&desc&size=50&stacked_fields=){500)

2019-10-25T10:24:19.703-03:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=c036e162-f72a-11e9-8ad4-00155d141905, journalOffset=39165385, codec=gelf, payloadSize=473, timestamp=2019-10-25T13:24:19.702Z, remoteAddress=/10.0.20.19:1105}

With that I can’t create the Quick Values.

---

<div class="post-metadata">

**Author:** ![juliomolonabreu](https://avatars.discourse-cdn.com/v4/letter/j/3e96dc/32.png) [@juliomolonabreu](https://community.graylog.org/u/juliomolonabreu)\
**Post date:** [October 25, 2019, 7:07pm UTC](https://community.graylog.org/t/error-create-quick-values/12516/2 "2019-10-25T19:07:06Z")

</div>

this has to do with the database message field.

the field in eslasticsearch shows size = 50

this may be the mistake

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 28, 2019, 9:29am UTC](https://community.graylog.org/t/error-create-quick-values/12516/3 "2019-10-28T09:29:38Z")

</div>

what graylog version did you use?

did you try to make a quick value out of the message field?

---

<div class="post-metadata">

**Author:** ![juliomolonabreu](https://avatars.discourse-cdn.com/v4/letter/j/3e96dc/32.png) [@juliomolonabreu](https://community.graylog.org/u/juliomolonabreu)\
**Post date:** [October 28, 2019, 11:23pm UTC](https://community.graylog.org/t/error-create-quick-values/12516/4 "2019-10-28T23:23:49Z")

</div>

My version is 2.2.  
The Elasticsearch version is 2.4.1

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 29, 2019, 7:05am UTC](https://community.graylog.org/t/error-create-quick-values/12516/5 "2019-10-29T07:05:59Z")

</div>

first the error from the log is not connected to your 500 loading error - because that is about ingesting a messages.

You tried quick values on the field message? That is a full text field and can contain really different kind of content. That is why this can fail - because the variance is to big. For that reason quick values on the message field is disabled.

For you - yes that can happen. You can only separate the data you are interested in to different fields and run the quick values on that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 12, 2019, 7:05am UTC](https://community.graylog.org/t/error-create-quick-values/12516/6 "2019-11-12T07:05:59Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.