I’m installing from el7 RPM using the supplied GL guidance. As soon as I add an rsyslog input (local only for now) the message quick values have the following ES error:
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
The same goes for adding only an input from the audit system. I have purged the ES data several times. I have installed slightly older versions of both ES and GL. Always with the same result.
My older el6 Graylog 2.2.3 server has no such issues with the same kinds of data.