# No message quickvalues in fresh install **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 18, 2017, 8:43pm UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554 "2017-12-18T20:43:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mntbighker](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mntbighker/32/1441_2.png) [@mntbighker](https://community.graylog.org/u/mntbighker)\ **Post date:** [December 18, 2017, 8:43pm UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/1 "2017-12-18T20:43:55Z")
I’m installing from el7 RPM using the supplied GL guidance. As soon as I add an rsyslog input (local only for now) the message quick values have the following ES error: > org.elasticsearch.transport.RemoteTransportException: [I1g5KBu][127.0.0.1:9300][indices:data/read/search[phase/query]] > Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. The same goes for adding only an input from the audit system. I have purged the ES data several times. I have installed slightly older versions of both ES and GL. Always with the same result. My older el6 Graylog 2.2.3 server has no such issues with the same kinds of data. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 19, 2017, 7:38am UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/2 "2017-12-19T07:38:52Z")
What Version of Graylog and what version of Elasticsearch did you installed with what guidance? What field did you do the quick values on? ---
**Author:** ![mntbighker](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mntbighker/32/1441_2.png) [@mntbighker](https://community.graylog.org/u/mntbighker)\ **Post date:** [December 19, 2017, 8:08pm UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/3 "2017-12-19T20:08:50Z")
Graylog 2.3.2+3df951e (Oracle Corporation 1.8.0\_151 on Linux 3.10.0-693.11.1.el7.x86\_64) [root@xxxxx ~]# yum list installed | grep elastic elasticsearch.noarch 5.6.5-1 @elasticsearch-5.x [http://docs.graylog.org/en/2.3/pages/installation/os/centos.html](http://docs.graylog.org/en/2.3/pages/installation/os/centos.html) I also tried Graylog 2.3.1 with Elastic 5.6.4 (I think) to see if a slightly older version would work. As the Subject says it’s the “message” quick values that produce the error. The “source” quick values work. In fact they all seem to work but “message”. Generate Chart and Statistics also fails for "message. with 500 errors. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 20, 2017, 8:15am UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/4 "2017-12-20T08:15:51Z")
Hi Mark, sorry it wasn’t clear for me that you only have that on the ‘message’ field. Please read the following elastic documentation: [https://www.elastic.co/guide/en/elasticsearch/reference/5.6/fielddata.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/fielddata.html) The ‘problem’ here is that Elasticsearch does not allow that kind of operation since version 5 on that kind of field type. In addition in Graylog 2.4 that is disabled and the option is removed from specific fields. The behavior you notice is on purpose. ---
**Author:** ![mntbighker](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mntbighker/32/1441_2.png) [@mntbighker](https://community.graylog.org/u/mntbighker)\ **Post date:** [December 20, 2017, 7:09pm UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/5 "2017-12-20T19:09:45Z")
Thanks for the info Jan. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 3, 2018, 7:10pm UTC](https://community.graylog.org/t/no-message-quickvalues-in-fresh-install/3554/6 "2018-01-03T19:10:01Z")
Closed on January 3, 2018, 7:10pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.