Upgrade from 5.0.12 to 5.1.6 causes error in WebUI message table

Graylog Central (peer support)
1

After upgrading Graylog from 5.0.12 to 5.1.6 the Web UI message table displays the following error.

While retrieving data for this widget, the following error(s) occurred:

  • Unable to perform search query: OpenSearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [gl2_message_id] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

I tried changing the field template, and rotating indexes, but it did not work.
Oddly the older indexes read that they contain messages from 54 years!

Enviro:
RedHat 9.2
Mongodb 6.0.11
Opensearch 2.10
Graylog 5.1.6

I have added a field mapping for gl2_message_id to keyword, rotated index.

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Can you share your server.log?

Rotating the indexes and recalculating the index ranges would be my first thought, can you confirm you recalculated the index ranges?

3

I did rotate the logs and remove all but two indexes. That did not work. I did added [streams] field to my index template and filtered my dashboard/search to a specific stream and that got rid of the error. Still not sure exactly what did it but it seeems to be working now.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.