Hi sir, Im have a problem to search quick values in graylog srv, when I click do get this message error
Could not load quick values
Loading quick values failed with status: Error: cannot GET http://192.168.1.24:9000/api/search/universal/relative/terms?query=*&range=300&field=message&order=message%3Adesc&size=50&stacked_fields= (500)
this is my elasticseach .log
[2019-07-19T12:51:10,450][DEBUG][o.e.a.s.TransportSearchAction] [7IC09yX] [1_0][3], node[7IC09yXCRcy3S0RXegxCVA], [P], s[STARTED], a[id=dJL72virT7yOLTeve2WXwA]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[1_0, graylog_0], indicesOptions=IndicesOptions[ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=true, ignore_aliases=false, ignore_throttled=true], types=[message], routing=‘null’, preference=‘null’, requestCache=null, scroll=null, maxConcurrentShardRequests=5, batchedReduceSize=512, preFilterShardSize=64, allowPartialSearchResults=true, source={“from”:0,“query”:{“bool”:{“must”:[{“match_all”:{“boost”:1.0}}],“filter”:[{“bool”:{“must”:[{“range”:{“timestamp”:{“from”:“2019-07-19 16:46:10.427”,“to”:“2019-07-19 16:51:10.427”,“include_lower”:true,“include_upper”:true,“boost”:1.0}}}],“adjust_pure_negative”:true,“boost”:1.0}}],“adjust_pure_negative”:true,“boost”:1.0}},“aggregations”:{“gl2_filter”:{“filter”:{“match_all”:{“boost”:1.0}},“aggregations”:{“gl2_terms”:{“terms”:{“field”:“message”,“size”:50,“min_doc_count”:1,“shard_min_doc_count”:0,“show_term_doc_count_error”:false,“order”:[{"_count":“desc”},{"_key":“asc”}]}}}},“missing”:{“missing”:{“field”:“message”}}}}}]
org.elasticsearch.transport.RemoteTransportException: [7IC09yX][192.168.1.24:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:670) ~[elasticsearch-6.6.2.jar:6.6.2]
at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:116) ~[elasticsearch-6.6.2.jar:6.6.2]
anyone can help me?