Quick question. I have Graylog (2.4.6) capturing some syslogging for me. I imported a cisco ASA extractor from the market place without any issues and I can see the messages showing up under my search. However, when I try to display world map data for the source IPs I get the following error in my elastic logs:
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
From what I can understand, this is intentional (Link: No message quickvalues in fresh install).
Any idea how I can display my data with these views without breaking the Graylog convention/standards?