robcowart
commented
5 years ago That error occurs when the index template was not installed into Elasticsearch before the index was created. The Logstash elasticsearch output should upload the index template when it starts.
I notice from the error message that you are using ElasticSearch 3.5.0. That release supports ONLY Elastic Stack 7.x. as is indicating in the install instructions.
Please always follow the instructions here in the repository. These are the only instructions that I maintain for each release.
nsolimando
Back in March or early April I followed this guide to setting up Elastiflow: https://www.catapultsystems.com/blogs/install-elastiflow-on-ubuntu-18-04-part-3/
Everything worked perfectly and I am shipping flow data from my pfsense CARP pair via softflowd. Everything is working GREAT on that instance.
I am now looking to install another instance of this for another data center and I am having problems.
Aside from the oracle-java8-installer package being decommissioned (which I've found a workaround for) I am running into problem after problem after problem and starting to lose my mind. What am I doing wrong here? I am so close. The server is accepting and indexing flow data because I can see it in Kibana's "discover" tab. But not 1 dashboard is working. They all throw this error:
Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [flow.server_hostname] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"elastiflow-3.5.0-2019.05.22","node":"BF2hOm7ISeqJj-ye2SFZjg","reason":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [flow.server_hostname] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}],"caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [flow.server_hostname] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [flow.server_hostname] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}},"status":400}
PLEASE HELP. WHAT DO I HAVE TO DO TO MAKE THIS WORK?
I even tried manually installing the exact same ELK versions (6.6.2) as my working instance and I am still getting these errors.