# Field disabled (elastic)

**URL:** <https://community.graylog.org/t/field-disabled-elastic/6257>\
**Category:** Graylog Central (peer support)\
**Created:** [August 6, 2018, 9:19am UTC](https://community.graylog.org/t/field-disabled-elastic/6257 "2018-08-06T09:19:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![charlie](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@charlie](https://community.graylog.org/u/charlie)\
**Post date:** [August 6, 2018, 9:19am UTC](https://community.graylog.org/t/field-disabled-elastic/6257/1 "2018-08-06T09:19:03Z")

</div>

Hi Everyone,

Quick question. I have Graylog (2.4.6) capturing some syslogging for me. I imported a cisco ASA extractor from the market place without any issues and I can see the messages showing up under my search. However, when I try to display world map data for the source IPs I get the following error in my elastic logs:

Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

From what I can understand, this is intentional (Link: [No message quickvalues in fresh install](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/2)).

Any idea how I can display my data with these views without breaking the Graylog convention/standards?

---

<div class="post-metadata">

**Author:** ![jebucha](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jebucha](https://community.graylog.org/u/jebucha)\
**Post date:** [August 6, 2018, 7:10pm UTC](https://community.graylog.org/t/field-disabled-elastic/6257/2 "2018-08-06T19:10:42Z")

</div>

Out of curiosity, which extractor are you using? I use a simple GROK pattern against our incoming ASA traffic to new field “source\_ip”, and the geolocation data executes fine.

---

<div class="post-metadata">

**Author:** ![charlie](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@charlie](https://community.graylog.org/u/charlie)\
**Post date:** [August 6, 2018, 9:57pm UTC](https://community.graylog.org/t/field-disabled-elastic/6257/3 "2018-08-06T21:57:42Z")

</div>

I’m actually trying sonicwall and ASA extractors from the market place

> **[Graylog](https://marketplace.graylog.org/addons/499f432f-bca2-4bfe-b973-fd027fba787a)**
>
> Graylog

  

> **[Graylog](https://marketplace.graylog.org/addons/bb638f6f-730e-491b-8876-32793bad9209)**
>
> Graylog

For the sonicwall extractor, when attempting to use the world map on the src\_ip field, I get all sorts of errors, despite it looking what I believe to be right:

[![Imgur](https://i.imgur.com/uBQv2pL.png?fb "Imgur") ](https://imgur.com/uBQv2pL)

I must have extractors wrong, because my log file is full of exceptions like this:

2018-08-07T09:56:54.802+12:00 ERROR [Extractor] Could not apply converter 2019-01-03 17:04:04.  
java.lang.IllegalArgumentException: Invalid format: “id=firewall sn=18B1690D3AB8 time…”  
at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?]

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [August 7, 2018, 9:56am UTC](https://community.graylog.org/t/field-disabled-elastic/6257/4 "2018-08-07T09:56:46Z")

</div>

Did you see this posting?

> **[Working with Cisco ASA / Nexus on Graylog](https://jalogisch.de/2018/working-with-cisco-asa-nexus-on-graylog/)**
>
> It is hard to have a working centralized logging environment when you run network devices. Every vendor has his own version and understanding of syslog. Additional most did not speak any kind of structured log format. Some speak some binary format....

---

<div class="post-metadata">

**Author:** ![charlie](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@charlie](https://community.graylog.org/u/charlie)\
**Post date:** [August 12, 2018, 8:18pm UTC](https://community.graylog.org/t/field-disabled-elastic/6257/5 "2018-08-12T20:18:02Z")

</div>

Thanks, that looks great

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 26, 2018, 8:18pm UTC](https://community.graylog.org/t/field-disabled-elastic/6257/6 "2018-08-26T20:18:14Z")

</div>

Closed on August 26, 2018, 8:18pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.