Upgrade from 5.0.12 to 5.1.6 causes error in WebUI message table

After upgrading Graylog from 5.0.12 to 5.1.6 the Web UI message table displays the following error.

While retrieving data for this widget, the following error(s) occurred:

  • Unable to perform search query: OpenSearch exception [type=illegal_argument_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [gl2_message_id] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

I tried changing the field template, and rotating indexes, but it did not work.
Oddly the older indexes read that they contain messages from 54 years!

RedHat 9.2
Mongodb 6.0.11
Opensearch 2.10
Graylog 5.1.6

I have added a field mapping for gl2_message_id to keyword, rotated index.

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Can you share your server.log?

Rotating the indexes and recalculating the index ranges would be my first thought, can you confirm you recalculated the index ranges?

I did rotate the logs and remove all but two indexes. That did not work. I did added [streams] field to my index template and filtered my dashboard/search to a specific stream and that got rid of the error. Still not sure exactly what did it but it seeems to be working now.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.