Hello,
gralog3
elasticsearch-6.6.0
I have problem with message field.
graylog.log:
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
curl -X GET http://localhost:9200/graylog_0 |grep data
{“graylog_0”:{“aliases”:{“graylog_deflector”:{}},“mappings”:{“message”:{“dynamic_templates”:[{“internal_fields”:{“match”:“gl2_*”,“mapping”:{“type”:“keyword”}}},{“store_generic”:{“match_mapping_type”:“string”,“mapping”:{“type”:“keyword”}}}],“properties”:{“facility”:{“type”:“keyword”},“full_message”:{“type”:“text”,“analyzer”:“standard”},“gl2_remote_ip”:{“type”:“keyword”},“gl2_remote_port”:{“type”:“keyword”},“gl2_source_input”:{“type”:“keyword”},“gl2_source_node”:{“type”:“keyword”},“level”:{“type”:“long”},“message”:{“type”:“text”,“analyzer”:“standard”},“message_geolocation”:{“type”:“keyword”},“source”:{“type”:“text”,“analyzer”:“analyzer_keyword”,“fielddata”:true},“streams”:{“type”:“keyword”},“timestamp”:{“type”:“date”,“format”:“yyyy-MM-dd HH:mm:ss.SSS”}}}},“settings”:{“index”:{“number_of_shards”:“4”,“provided_name”:“graylog_0”,“creation_date”:“1550478934256”,“analysis”:{“analyzer”:{“analyzer_keyword”:{“filter”:“lowercase”,“tokenizer”:“keyword”}}},“number_of_replicas”:“0”,“uuid”:“ANAW03f8T_-DwKF_OOgbRg”,“version”:{“created”:“6060099”}}}}}
help 