# Field data errors

**URL:** <https://community.graylog.org/t/field-data-errors/3874>\
**Category:** Graylog Central (peer support)\
**Created:** [January 20, 2018, 3:46pm UTC](https://community.graylog.org/t/field-data-errors/3874 "2018-01-20T15:46:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eddywebs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/eddywebs/32/1620_2.png) [@eddywebs](https://community.graylog.org/u/eddywebs)\
**Post date:** [January 20, 2018, 3:46pm UTC](https://community.graylog.org/t/field-data-errors/3874/1 "2018-01-20T15:46:00Z")

</div>

I found this topic in forums before but no resolution whenever loading more than 1k of messages we receive below errors from the following endpoints.  
**[http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=\*&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false](http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false)**

```
{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}

```

**x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=86400&filter=streams%3A5a31a2386c9bb677a71b4761&interval=day&field=message&cardinality=false**

```
{"message":"Unable to retrieve field histogram\n\nFielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","details":["Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."]}

```

ES documentation has a solution ([https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html)) but the indices are created by graylog.  
Is there anything we can adjust in config file so that graylog makes sure to enable fielddata on fields before sending data to ES ?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 22, 2018, 9:05am UTC](https://community.graylog.org/t/field-data-errors/3874/2 "2018-01-22T09:05:00Z")

</div>

Hej Adi,

you already pointed to the Page ( [https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html#\_enabling\_fielddata\_on\_literal\_text\_literal\_fields](https://www.elastic.co/guide/en/elasticsearch/reference/5.0/fielddata.html#_enabling_fielddata_on_literal_text_literal_fields) ) that has the solution …

You need to create a Custom Index Mapping ( [http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings) )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 5, 2018, 9:13am UTC](https://community.graylog.org/t/field-data-errors/3874/3 "2018-02-05T09:13:27Z")

</div>

Closed on February 5, 2018, 9:13am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.