Text aggregations are failing

[dbason]

When generating the list of hosts I get the following error in the Kibana logs:
"Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory"

Should the source, host, and type aggregations be using the .raw or .keyword fields?

[elessarkrin]

If you are getting these issues is probably that you don't have the type field as keyword, all host, source, type should be keyword

[dbason]

We're using the default logstash template which analyzes the base field and uses .keyword for the keyword fields, and I'd prefer to keep using this scheme. Not a problem, I can just fork and update it for my environment.

[sunomie]

@dbason any chance you'd be willing to share your fork? I'm running into this same issue (type is text and have type.keyword), but I cannot seem to figure out how to patch kibana-logbrowser to use type.keyword instead. Thanks!

[dbason]

@sunomie I actually didn't pursue this sorry. We've ended up using the logtrail plugin instead - https://github.com/sivasamyk/logtrail