search

searchtechnologies / kibana-logbrowser

The Search Technologies Log Browser
25 stars 9 forks source link

Text aggregations are failing #5

Open dbason opened 7 years ago

dbason commented 7 years ago

When generating the list of hosts I get the following error in the Kibana logs: "Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory"

Should the source, host, and type aggregations be using the .raw or .keyword fields?

elessarkrin commented 7 years ago

If you are getting these issues is probably that you don't have the type field as keyword, all host, source, type should be keyword

dbason commented 7 years ago

We're using the default logstash template which analyzes the base field and uses .keyword for the keyword fields, and I'd prefer to keep using this scheme. Not a problem, I can just fork and update it for my environment.

sunomie commented 6 years ago

@dbason any chance you'd be willing to share your fork? I'm running into this same issue (type is text and have type.keyword), but I cannot seem to figure out how to patch kibana-logbrowser to use type.keyword instead. Thanks!

dbason commented 6 years ago

@sunomie I actually didn't pursue this sorry. We've ended up using the logtrail plugin instead - https://github.com/sivasamyk/logtrail