Field data errors

I found this topic in forums before but no resolution whenever loading more than 1k of messages we receive below errors from the following endpoints.
http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=*&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false

{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}

x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false

{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}

ES documentation has a solution (https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html) but the indices are created by graylog.
Is there anything we can adjust in config file so that graylog makes sure to enable fielddata on fields before sending data to ES ?

Hej Adi,

you already pointed to the Page ( https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html#_enabling_fielddata_on_literal_text_literal_fields ) that has the solution …

You need to create a Custom Index Mapping ( http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings )

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.