# Loading field graph for 'message' with status 500 graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 13, 2018, 8:23pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554 "2018-03-13T20:23:29Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![dualcore](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@dualcore](https://community.graylog.org/u/dualcore)\ **Post date:** [March 13, 2018, 8:23pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/1 "2018-03-13T20:23:29Z")
I’m trying to add the generate chart or quick values to a dashboard. Once I select Quick Values or Generate Chart I get the following error: loading field graph for ‘message’ with status 500 graylog. ![errors](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c3589392d8faa03561c4d28d43a6a4b960a8f24d.png) I found this post: [Error with “message” and “source” fields](https://community.graylog.org/t/error-with-message-and-source-fields/3666/7) but one of the solutions was to review the UI analysis disabled for fields, which I don’t apparently have. I restarted the Elasticsearch daemon, but that didn’t resolve anything. Can someone point me in a direction to dig down deeper? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 13, 2018, 9:13pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/2 "2018-03-13T21:13:08Z")
What’s in the logs of your Graylog and Elasticsearch nodes? [http://docs.graylog.org/en/2.4/pages/configuration/file\_location.html](http://docs.graylog.org/en/2.4/pages/configuration/file_location.html) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 14, 2018, 7:28am UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/3 "2018-03-14T07:28:31Z")
What Version of Graylog and Elasticsearch did you use? ---
**Author:** ![jorgermaia](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jorgermaia/32/1966_2.png) [@jorgermaia](https://community.graylog.org/u/jorgermaia)\ **Post date:** [March 15, 2018, 11:18am UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/4 "2018-03-15T11:18:05Z")
I’m having the same problem when I try to generate charts or quick values. Elasticsearch 5.6.7 Graylog 2.4.3 ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 15, 2018, 11:35am UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/5 "2018-03-15T11:35:50Z")
> [@jorgermaia](#): > > I’m having the same problem when I try to generate charts or quick values. Maybe you should answer the same questions then… > [@Loading field graph for 'message' with status 500 graylog](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/2): > > What’s in the logs of your Graylog and Elasticsearch nodes? [http://docs.graylog.org/en/2.4/pages/configuration/file\_location.html](http://docs.graylog.org/en/2.4/pages/configuration/file_location.html) > [@Loading field graph for 'message' with status 500 graylog](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/3): > > What Version of Graylog and Elasticsearch did you use? ---
**Author:** ![dualcore](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@dualcore](https://community.graylog.org/u/dualcore)\ **Post date:** [March 20, 2018, 8:36pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/6 "2018-03-20T20:36:36Z")
Hi, Graylog: 2.3.2 Elasticsearch: 5.6.5 Graylog log: [https://pastebin.com/Hf66k5PM](https://pastebin.com/Hf66k5PM) Elasticsearch log: [https://pastebin.com/rHGMQHTt](https://pastebin.com/rHGMQHTt) ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 21, 2018, 8:27am UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/7 "2018-03-21T08:27:51Z")
If you’ve upgraded Elasticsearch recently to version 5.x, try rotating the write-active index (System/Indices/Index Set/Maintenance in the web interface). ---
**Author:** ![dualcore](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@dualcore](https://community.graylog.org/u/dualcore)\ **Post date:** [March 21, 2018, 8:19pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/8 "2018-03-21T20:19:50Z")
I seem to be receiving the same error. Have any other suggestions? ---
**Author:** ![WikiBit](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@WikiBit](https://community.graylog.org/u/WikiBit)\ **Post date:** [April 1, 2018, 11:46am UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/9 "2018-04-01T11:46:57Z")
I have a similar issue: I’ve just setup a first single node (basic) setup of graylog. For testing purposes. Followed the instructions from the Graylog 2.4 documentation for the out of the box setup, and created an input, capturing logs from a lab firewall. (Specs: a VM with 8GB RAM, 100GB disk) But when I go to “SEARCH” in the menu (which defaults to the last 5 minutes) I get 1 or 2 errors: The error I get all the time: Error Loading field graph for ‘message’ failed with status 500 and the Message Graph does not display, in stead it shows “Field graph could not be loaded, please try again after reloading the page.” Sometimes I also get the error: Could not update field graph data Updating field graph data failed: Error: cannot GET [http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=\*&range=300&interval=minute&field=message&cardinality=false](http://x.x.x.x:9000/api/search/universal/relative/fieldhistogram?query=%2A&range=300&interval=minute&field=message&cardinality=false) (500) Then the Histogram also does not show. anyone an idea how to fix this? When I get the first error, I see the below in /var/log/elasticsearch/graylog.log: ```auto [2018-04-01T13:41:53,608][DEBUG][o.e.a.s.TransportSearchAction] [7HqU0Vm] [graylog_0][3], node[7HqU0VmWSMOAmmx7Ynio-Q], [P], s[STARTED], a[id=MJrhS6G9TqqulK_WkgIrDQ]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[graylog_0], indicesOptions=IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true], types=[message], routing='null', preference='null', requestCache=null, scroll=null, maxConcurrentShardRequests=5, batchedReduceSize=512, preFilterShardSize=64, source={ "from" : 0, "query" : { "bool" : { "must" : [ { "match_all" : { "boost" : 1.0 } } ], "filter" : [ { "bool" : { "must" : [ { "range" : { "timestamp" : { "from" : "2018-04-01 11:36:53.600", "to" : "2018-04-01 11:41:53.600", "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, "aggregations" : { "gl2_histogram" : { "date_histogram" : { "field" : "timestamp", "interval" : "1m", "offset" : 0, "order" : { "_key" : "asc" }, "keyed" : false, "min_doc_count" : 0 }, "aggregations" : { "gl2_stats" : { "stats" : { "field" : "message" } } } } } }}] lastShard [true] org.elasticsearch.transport.RemoteTransportException: [7HqU0Vm][127.0.0.1:9300][indices:data/read/search[phase/query]] Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:336) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:111) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.index.query.QueryShardContext.getForField(QueryShardContext.java:166) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceConfig.resolve(ValuesSourceConfig.java:96) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.resolveConfig(ValuesSourceAggregationBuilder.java:297) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:290) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder$LeafOnly.doBuild(ValuesSourceAggregationBuilder.java:42) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:347) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactory.(AggregatorFactory.java:187) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregatorFactory.(ValuesSourceAggregatorFactory.java:40) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.bucket.histogram.DateHistogramAggregatorFactory.(DateHistogramAggregatorFactory.java:53) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.bucket.histogram.DateHistogramAggregationBuilder.innerBuild(DateHistogramAggregationBuilder.java:331) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:291) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.support.ValuesSourceAggregationBuilder.doBuild(ValuesSourceAggregationBuilder.java:39) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AbstractAggregationBuilder.build(AbstractAggregationBuilder.java:126) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.aggregations.AggregatorFactories$Builder.build(AggregatorFactories.java:347) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.parseSource(SearchService.java:655) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.createContext(SearchService.java:485) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:461) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:257) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:343) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.action.search.SearchTransportService$6.messageReceived(SearchTransportService.java:340) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) ~[elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.transport.TransportService$7.doRun(TransportService.java:654) [elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:674) [elasticsearch-5.6.8.jar:5.6.8] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.6.8.jar:5.6.8] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_161] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_161] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161] ``` ---
**Author:** ![dualcore](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@dualcore](https://community.graylog.org/u/dualcore)\ **Post date:** [April 2, 2018, 1:52pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/10 "2018-04-02T13:52:18Z")
I haven’t found a solution yet. I’m still trying to figure it out. My system doesn’t allow internet access behind my FW. I’m curious, if I take this VM to another site and put it online, if it would resolve itself. ---
**Author:** ![WikiBit](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@WikiBit](https://community.graylog.org/u/WikiBit)\ **Post date:** [April 2, 2018, 6:25pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/11 "2018-04-02T18:25:38Z")
My system has standard internet access. So I doubt the issues has to do with that. I’m not a graylog expert or developer, but can it have something to do with the size or type of messages which are sent to the graylog server? My installation is fairly vanilla, and at the moment, only getting messages from my Pfsense firewall ---
**Author:** ![WikiBit](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@WikiBit](https://community.graylog.org/u/WikiBit)\ **Post date:** [April 7, 2018, 6:16pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/12 "2018-04-07T18:16:51Z")
Still looking for a solution. I’ve been searching on the web, but nothing comes close to a solution ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 21, 2018, 6:19pm UTC](https://community.graylog.org/t/loading-field-graph-for-message-with-status-500-graylog/4554/13 "2018-04-21T18:19:43Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.