Fielddata automatically enabled for "source" field

Tim - Just so we are on the same page. your link to elastic search is pointing to version 7.6 and the latest Graylog elasticsearch version is at 6.8.x. In the elastic search site, current refers to -> 7.6.
Also, would you like to share a picture of how your cluster ,index set configuration of your environment looks like ?
Are you at version 3.1 or 3.2 of Graylog ?

Bookmark this.