# Loading field graph for 'message' failed with status 500 **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [April 7, 2018, 6:19pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-failed-with-status-500/4903 "2018-04-07T18:19:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![WikiBit](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@WikiBit](https://community.graylog.org/u/WikiBit)\ **Post date:** [April 7, 2018, 6:19pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-failed-with-status-500/4903/1 "2018-04-07T18:19:30Z")
Hi, I’ve just setup a first single node (basic) setup of graylog. For testing purposes. Followed the instructions from the Graylog 2.4 documentation for the out of the box setup, and created an input, capturing logs from a lab firewall. (Specs: a VM with 8GB RAM, 100GB disk) But when I go to “SEARCH” (which defaults to the last 5 minutes) I get 1 or 2 errors: The error I get all the time: Error Loading field graph for ‘message’ failed with status 500 and the Message Graph does not display, in stead it shows “Field graph could not be loaded, please try again after reloading the page.” Sometimes I also get the error: Could not update field graph data Updating field graph data failed: Error: cannot GET [http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=\*&range=300&interval=minute&field=message&cardinality=false](http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=300&interval=minute&field=message&cardinality=false) (500) Then the Histogram also does not show. anyone an idea how to fix this? When I get the first error, I see the below in /var/log/elasticsearch/graylog.log: [2018-04-01T13:41:53,608][DEBUG][o.e.a.s.TransportSearchAction] [7HqU0Vm] [graylog\_0][3], node[7HqU0VmWSMOAmmx7Ynio-Q], [P], s[STARTED], a[id=MJrhS6G9TqqulK\_WkgIrDQ]: Failed to execute [SearchRequest{searchType=QUERY\_THEN\_FETCH, indices=[graylog\_0], indicesOptions=IndicesOptions[id=38, ignore\_unavailable=false, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=true, forbid\_closed\_indices=true], types=[message], routing=‘null’, preference=‘null’, requestCache=null, scroll=null, maxConcurrentShardRequests=5, batchedReduceSize=512, preFilterShardSize=64, source={ “from” : 0, “query” : { “bool” : { “must” : [ { “match\_all” : { “boost” : 1.0 } } ], “filter” : [ { “bool” : { “must” : [ { “range” : { “timestamp” : { “from” : “2018-04-01 11:36:53.600”, “to” : “2018-04-01 11:41:53.600”, “include\_lower” : true, “include\_upper” : true, “boost” : 1.0 } } } ], “disable\_coord” : false, “adjust\_pure\_negative” : true, “boost” : 1.0 } } ], “disable\_coord” : false, “adjust\_pure\_negative” : true, “boost” : 1.0 } }, “aggregations” : { “gl2\_histogram” : { “date\_histogram” : { “field” : “timestamp”, “interval” : “1m”, “offset” : 0, “order” : { “\_key” : “asc” }, “keyed” : false, “min\_doc\_count” : 0 }, “aggregations” : { “gl2\_stats” : { “stats” : { “field” : “message” } } } } } }}] lastShard [true] org.elasticsearch.transport.RemoteTransportException: [7HqU0Vm][127.0.0.1:9300][indices:data/read/search[phase/query]] Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:336) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:111) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.index.query.QueryShardContext.getForField(QueryShardContext.java:166) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceConfig.resolve(ValuesSourceConfig.java:96) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:297) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:290) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder$LeafOnly.doBuild(ValuesSourceAggregationBuilder.java:42) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:347) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactory.(AggregatorFactory.java:187) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregatorFactory.(ValuesSourceAggregatorFactory.java:40) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.bucket.histogram.DateHistogramAggregatorFactory.(DateHistogramAggregatorFactory.java:53) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.bucket.histogram.DateHistogramAggregationBuilder.innerBuild(DateHistogramAggregationBuilder.java:331) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:291) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:39) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:347) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.parseSource(SearchService.java:655) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.createContext(SearchService.java:485) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:461) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:257) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:343) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:340) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.transport.TransportService$7.doRun(TransportService.java:654) [elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:674) [elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.6.8.jar:5.6.8] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0\_161] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0\_161] at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_161] ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [April 9, 2018, 9:33am UTC](https://community.graylog.org/t/loading-field-graph-for-message-failed-with-status-500/4903/2 "2018-04-09T09:33:13Z")
did you checked that your elasticsearch is present and graylog can connect? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 23, 2018, 9:33am UTC](https://community.graylog.org/t/loading-field-graph-for-message-failed-with-status-500/4903/3 "2018-04-23T09:33:38Z")
Closed on April 23, 2018, 9:33am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.