No message quickvalues in fresh install

(Mark M) #1

I’m installing from el7 RPM using the supplied GL guidance. As soon as I add an rsyslog input (local only for now) the message quick values have the following ES error:

org.elasticsearch.transport.RemoteTransportException: [I1g5KBu][][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

The same goes for adding only an input from the audit system. I have purged the ES data several times. I have installed slightly older versions of both ES and GL. Always with the same result.

My older el6 Graylog 2.2.3 server has no such issues with the same kinds of data.

(Jan Doberstein) #2

What Version of Graylog and what version of Elasticsearch did you installed with what guidance?

What field did you do the quick values on?

Field disabled (elastic)
(Mark M) #3

Graylog 2.3.2+3df951e (Oracle Corporation 1.8.0_151 on Linux 3.10.0-693.11.1.el7.x86_64)

[root@xxxxx ~]# yum list installed | grep elastic
elasticsearch.noarch 5.6.5-1 @elasticsearch-5.x

I also tried Graylog 2.3.1 with Elastic 5.6.4 (I think) to see if a slightly older version would work.

As the Subject says it’s the “message” quick values that produce the error. The “source” quick values work. In fact they all seem to work but “message”. Generate Chart and Statistics also fails for "message. with 500 errors.

(Jan Doberstein) #4

Hi Mark,

sorry it wasn’t clear for me that you only have that on the ‘message’ field. Please read the following elastic documentation:

The ‘problem’ here is that Elasticsearch does not allow that kind of operation since version 5 on that kind of field type. In addition in Graylog 2.4 that is disabled and the option is removed from specific fields.

The behavior you notice is on purpose.

(Mark M) #5

Thanks for the info Jan.

(system) closed #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.