Error with event definition and agregation

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
hello after upgrading to 5.0 ==> 5.1.1 i have problem with agregation

the error is

Aggregation search failed (triggered 4 hours ago)

Event definition Cronjob Failure update (6472091e60f0bb677fb206e9) failed: Elasticsearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [full_message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

2. Describe your environment:
*ubuntu server 20.4

  • Package Version:
    graylog 5.1.1
    3. What steps have you already taken to try and solve the problem?
    i follow the documentation for upgrading to 5.1.1 and i have no error when i have upgrade after upgrading i restart the server and i have this error

Aggregation search failed (triggered 4 hours ago)

Event definition Cronjob Failure update (6472091e60f0bb677fb206e9) failed: Elasticsearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [full_message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

4. How can the community help?

if you have idea for helping me i take thanks you
its this who generate the error

resolved just need to change alert definition

1 Like

Thanks for the feed back :+1:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.