DAPE.work
Login Register

Fielddata Disabled

Severity: High
Elasticsearch Version: 7.10.2

Problem

Aggregations fail due to disabled fielddata on text fields

Root Cause

Fielddata is disabled on text fields, preventing aggregation operations

How to Detect

Symptoms

  • Aggregation queries return errors related to fielddata being disabled
  • Elasticsearch logs show 'fielddata is disabled on text fields' errors
  • Monitoring dashboards indicate failed aggregation metrics

Commands

GET /<index>/_mapping
GET /<index>/_search with 'explain' parameter
GET /_cat/indices?v

Remediation Steps

  1. Identify text fields used in aggregations from index mappings
  2. Update index mappings to enable fielddata on relevant text fields: PUT /<index>/_mapping with 'fielddata': true
  3. Reindex data if necessary to apply mapping changes
  4. Alternatively, create keyword sub-fields for aggregation: 'fieldname.keyword' and update queries accordingly

Prevention

  • Define keyword sub-fields in index mappings for fields intended for aggregations
  • Use 'keyword' type fields for aggregations instead of text fields
  • Implement index templates with appropriate mappings for future indices

Production Example

curl -X PUT "localhost:9200/<index>/_mapping" -H 'Content-Type: application/json' -d '{"properties": {"fieldname": {"type": "text", "fields": {"keyword": {"type": "keyword"}}}}}'
View all Elasticsearch errors