Pie chart not working

This support forum board is for support questions relating to Nagios Log Server, our solution for managing and monitoring critical log data.
shifty
Posts: 44
Joined: Thu Feb 25, 2021 2:58 am

Re: Pie chart not working

Post by shifty »

Here is the output of

Code: Select all

tail -Fn0 /var/log/apache2/error.log /var/log/apache2/other_vhosts_access.log /var/log/elasticsearch/*

Code: Select all

127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:34 +0200] "GET /nagioslogserver/api/backend/logstash-2021.05.14,logstash-2021.05.13/_mapping/field/severity_label HTTP/1.1" 200 1531 "http://xxx.xxx.xxx.xxx/nagio/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:38 +0200] "GET /nagioslogserver/app/panels/terms/module.php?ver=2.0.0-3.1.1-nagios-5 HTTP/1.1" 200 1333 "http://xxx.xxx.xxx.xxx/nagioslogserver/dashboard" "Mozill x64; rv:88.0) Gecko/20100101 Firefox/88.0"

==> /var/log/elasticsearch/098e8e98-3ec3-4452-874b-9c6952b2c244.log <==
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][0], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][0]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][2], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][2]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][4], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][3], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][3]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][1], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][1]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][2], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][2]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][1], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][1]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,311][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.13][0], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.13][0]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][4], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,314][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] All shards failed for phase: [query]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][4]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more
[2021-05-14 09:55:38,312][DEBUG][action.search.type       ] [7b9ceae4-cc7e-462d-89d2-256de277dc28] [logstash-2021.05.14][3], node[54UU5cUOQXiRW551KQb4ew], [P], s[STARTED]: Failed to execute [org.elasticsearc2a9b77c5] lastShard [true]
org.elasticsearch.search.query.QueryPhaseExecutionException: [logstash-2021.05.14][3]: query[ConstantScore(*:*)],from[0],size[0]: Query Failed [Failed to execute main query]
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:163)
        at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:301)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:312)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231)
        at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228)
        at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.elasticsearch.ElasticsearchException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:80)
        at org.elasticsearch.search.facet.terms.strings.TermsStringFacetExecutor$Collector.setNextReader(TermsStringFacetExecutor.java:111)
        at org.elasticsearch.common.lucene.search.FilteredCollector.setNextReader(FilteredCollector.java:67)
        at org.elasticsearch.common.lucene.MultiCollector.setNextReader(MultiCollector.java:68)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:612)
        at org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:191)
        at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
        at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:117)
        ... 8 more
Caused by: org.elasticsearch.common.util.concurrent.UncheckedExecutionException: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2203)
        at org.elasticsearch.common.cache.LocalCache.get(LocalCache.java:3937)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache.load(IndicesFieldDataCache.java:167)
        at org.elasticsearch.index.fielddata.plain.AbstractIndexFieldData.load(AbstractIndexFieldData.java:74)
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.fail(DisabledIndexFieldData.java:65)
        at org.elasticsearch.index.fielddata.plain.DisabledIndexFieldData.loadDirect(DisabledIndexFieldData.java:56)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:180)
        at org.elasticsearch.indices.fielddata.cache.IndicesFieldDataCache$IndexFieldCache$1.call(IndicesFieldDataCache.java:167)
        at org.elasticsearch.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742)
        at org.elasticsearch.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)
        at org.elasticsearch.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)
        at org.elasticsearch.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)
        at org.elasticsearch.common.cache.LocalCache$Segment.get(LocalCache.java:2197)
        ... 19 more

==> /var/log/apache2/other_vhosts_access.log <==
127.0.0.1:80 x.x.x.xx - - [14/May/2021:09:55:38 +0200] "POST /nagioslogserver/api/backend/logstash-2021.05.14,logstash-2021.05.13/_search HTTP/1.1" 200 355 "http://xxx.xxx.xxx.xxx/nagioslogserver/dashboard"  Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0"
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Pie chart not working

Post by ssax »

For whatever reason I'm unable to replicate it through the web interface but I can replicate it if I run this command:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label"}}}}'
I assume that also fails on yours?

This seems to work, does it on yours?

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label.raw"}}}}'
EDITED: Had a mistake in the second one.
shifty
Posts: 44
Joined: Thu Feb 25, 2021 2:58 am

Re: Pie chart not working

Post by shifty »

The first command output:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label"}}}}'

Code: Select all

{
"error" : "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][0]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on                               severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][1]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden                               on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][2]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbi                              dden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label];}{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][3]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }{[54UU5cUOQXiRW551KQb4ew][logstash-2021.05.10][4]: ElasticsearchException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: UncheckedExecutionException[org.elasticsearch.ElasticsearchIllegalStateException: Field data loading is forbidden on severity_label]; nested: ElasticsearchIllegalStateException[Field data loading is forbidden on severity_label]; }]",
"status" : 500
}
The second output:

Code: Select all

curl -XGET localhost:9200/logstash-2021.05.10/_search?pretty=1 -d '{"size": 0,"aggregations": {"the_test": {"terms": {"field": "severity_label.raw"}}}}'

Code: Select all

{
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 290586,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "the_test" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [ {
        "key" : "Informational",
        "doc_count" : 86658
      }, {
        "key" : "Notice",
        "doc_count" : 24952
      }, {
        "key" : "Error",
        "doc_count" : 240
      }, {
        "key" : "Warning",
        "doc_count" : 224
      }, {
        "key" : "Debug",
        "doc_count" : 16
      } ]
    }
  }
}
gsmith
Posts: 1253
Joined: Tue Mar 02, 2021 11:15 am

Re: Pie chart not working

Post by gsmith »

Hi,

That matches what I am seeing. I need to do some research....

Will let you know what I find.

Thanks
gsmith
Posts: 1253
Joined: Tue Mar 02, 2021 11:15 am

Re: Pie chart not working

Post by gsmith »

Hey Shifty,

I was able to select 'host' and 'host.raw' from the fields drop-down menu.
Image11.jpg
Are you able to do the same?

If not please export your dashboard for me and give me the steps you are using
to create the pie chart.

Thanks
You do not have the required permissions to view the files attached to this post.
shifty
Posts: 44
Joined: Thu Feb 25, 2021 2:58 am

Re: Pie chart not working

Post by shifty »

Hi gsmith,

no im note able to select host or host.raw from the drop-down menu.

Here are the steps for creating the pie chart:

1:
Select "empty dashboard"
1.PNG
2:
Creating the Dashboard
2.PNG
3:
Creating the pie chart
3.PNG
4:
No suggestions are shown except for _type. I wrote host in myself. The Pie Chart doesnt change.
4.PNG
5.PNG
You do not have the required permissions to view the files attached to this post.
shifty
Posts: 44
Joined: Thu Feb 25, 2021 2:58 am

Re: Pie chart not working

Post by shifty »

5:
I changed "host" to "host.raw" (host.raw also not suggest) but the pie chart changend:
6.PNG
7.PNG
These are all the steps that I have taken. :)
You do not have the required permissions to view the files attached to this post.
gsmith
Posts: 1253
Joined: Tue Mar 02, 2021 11:15 am

Re: Pie chart not working

Post by gsmith »

Hey there,

It's funny, but when I get my field list it shows xxx.raw as available for text fields:
shifty.jpg
I went ahead and created the dashboard with two pie charts, one using severity_label and one using severity_label.raw and they are identical:
shifty1.jpg
So it seems like something is different between yours and my installs.
I am running 2.1.8.

I exported my dashboard (shifty-1621537068546.txt) so please load it and see what happens.
You'll need to rename it first: shifty-1621537068546.txt ---> shifty-1621537068546.json

Thanks
You do not have the required permissions to view the files attached to this post.
shifty
Posts: 44
Joined: Thu Feb 25, 2021 2:58 am

Re: Pie chart not working

Post by shifty »

Hey gsmith,

thank you for your help! So i imported your dashboard and thats what happened :D
piechart1.png
You do not have the required permissions to view the files attached to this post.
gsmith
Posts: 1253
Joined: Tue Mar 02, 2021 11:15 am

Re: Pie chart not working

Post by gsmith »

Awesome!

I am locking this thread....so I can get back to working on your Cisco ASA Dashboard issue :lol:
Locked