1

I've encountered a classic problem, hovewer, no page on SO or any other Q&A or forum has helped me.

I need to extract a numerical value of parameter "wsProcessingElapsedTimeMS" out of string, like (where the parameter is contained in the message field):

2018-07-31 07:37:43,740|DEBUG|[ACTIVE] ExecuteThread: '43' for queue: 
'weblogic.kernel.Default (self-tuning)' 
|LoggerHandler|logMessage|sessionId=9AWTu
wsOperationName=FindBen wsProcessingEndTime=2018-07-31 07:37:43.738 
wsProcessingElapsedTimeMS=6 httpStatus=200 outgoingAddress=172.xxx.xxx.xxx

and keep getting error:

"type":"illegal_argument_exception","reason":"Fielddata is disabled on text 
fields by default. Set fielddata=true on [message] in order to load fielddata 
in memory by uninverting the inverted index. Note that this can however use 
significant memory. Alternatively use a keyword field instead."

Point is, I've already did run the query (by Dev Tools in Kibana GUI if that matters) to mark a field as fielddata in following way:

PUT my_index/_mapping/message
{
   "message": {
      "properties": {
        "publisher": {
          "type": "text",
          "fielddata": true
        }
      }
   }
}

, which returned brief information:

{
  "acknowledged": true
}

After which I've tried to rebuilt the index like:

POST _reindex?wait_for_completion=false
{
  "source": {
    "index": "my_index"
  },
  "dest": {
    "index": "my_index"
  }
}

(the ?wait_for_completion=false flag is set because otherwise it was a timeout; theres a lot of data in the system now).

And finally, having performed above steps, I've also tried to relaunch the kibana and elasticsearch services (processes) to force a reindexing (which tool really long).

Also, using the "message.keyword" instead of "message" (as suggested in the official documentation) is not helping - it's just empty in most of cases. I'm using the Kibana to access the ElasticSearch engine. ElasticSearch v. 5.6.3 Kibana v. 5.6.3 Logstash v. 5.5.0

Any suggestion will be appreciated, even regarding the use of additional plugins (provided they have a release compliant with above Kibana/ElasticSearch/Logstash versions, as I can't update them to newer right now).

Jacek Jabłoński
  • 11
  • 1
  • 4

1 Answers1

-1
PUT your_index/_mapping/your_type
{    
    "your_type": {
      "properties": {
        "publisher": {
          "type": "text",
          "fielddata": true
        }
      }
    }
}
Sebastián Palma
  • 32,692
  • 6
  • 40
  • 59
Vikash Kumar
  • 1
  • 1