I found this topic in forums before but no resolution whenever loading more than 1k of messages we receive below errors from the following endpoints.
http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=*&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false
{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}
x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false
{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}
ES documentation has a solution (https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html) but the indices are created by graylog.
Is there anything we can adjust in config file so that graylog makes sure to enable fielddata on fields before sending data to ES ?