Exception Kibana显示查询结果搜索错误

我使用Kibana timelion插件进行了一些查询，并生成了一些时间序列数据。 这是我的问题

.es（index='linux\u cpu-*'，metric='avg:cpu（%）'，split='Hostname:5'）

我没有发现这个查询有任何错误，只是不理解为什么它不能生成所需的结果。然后，当我交叉检查elasticsearch数据日志时，我发现以下语句搜索解析错误

[2016-06-26 23:32:43,290][DEBUG][action.search            ] [Bentley Wittman] [linux_cpu-2015.01.21][4], node[rtIRvgffRha3nFqYhjh8YA], [P], v[2], s[STARTED], a[id=xIKFCsvnRKaGqt7XyJtHNg]: Failed to execute [org.elasticsearch.action.search.SearchRequest@148c67f] lastShard [true]
RemoteTransportException[[Bentley Wittman][172.16.1.238:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":1420096382918,"lte":1422689282919,"format":"epoch_millis"}}}],"must_not":[],"filter":{}}},"aggs":{"q":{"meta":{"type":"split"},"filters":{"filters":{"*":{"query_string":{"query":"*"}}}},"aggs":{"Hostname":{"meta":{"type":"split"},"terms":{"field":"Hostname","size":5},"aggs":{"time_buckets":{"meta":{"type":"time_buckets"},"date_histogram":{"field":"@timestamp","interval":"1w","time_zone":"Asia/Shanghai","extended_bounds":{"min":1420096382918,"max":1422689282919},"min_doc_count":0},"aggs":{"avg(CPU(%))":{"avg":{"field":"CPU(%)"}}}}}}}}},"size":0}]]; nested: IllegalStateException[Field data loading is forbidden on [Hostname]];
Caused by: SearchParseException[failed to parse search source [{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":1420096382918,"lte":1422689282919,"format":"epoch_millis"}}}],"must_not":[],"filter":{}}},"aggs":{"q":{"meta":{"type":"split"},"filters":{"filters":{"*":{"query_string":{"query":"*"}}}},"aggs":{"Hostname":{"meta":{"type":"split"},"terms":{"field":"Hostname","size":5},"aggs":{"time_buckets":{"meta":{"type":"time_buckets"},"date_histogram":{"field":"@timestamp","interval":"1w","time_zone":"Asia/Shanghai","extended_bounds":{"min":1420096382918,"max":1422689282919},"min_doc_count":0},"aggs":{"avg(CPU(%))":{"avg":{"field":"CPU(%)"}}}}}}}}},"size":0}]]; nested: IllegalStateException[Field data loading is forbidden on [Hostname]];
    at org.elasticsearch.search.SearchService.parseSource(SearchService.java:855)
    at org.elasticsearch.search.SearchService.createContext(SearchService.java:654)
    at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:620)
    at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:371)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)
    at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33)
    at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)
    at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:376)
    at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.IllegalStateException: Field data loading is forbidden on [Hostname]
    at org.elasticsearch.index.fielddata.IndexFieldDataService$1.build(IndexFieldDataService.java:74)
    at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:275)
    at org.elasticsearch.search.aggregations.support.ValuesSourceParser.config(ValuesSourceParser.java:209)
    at org.elasticsearch.search.aggregations.bucket.terms.TermsParser.parse(TermsParser.java:76)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:198)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:176)
    at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:103)
    at org.elasticsearch.search.aggregations.AggregationParseElement.parse(AggregationParseElement.java:60)
    at org.elasticsearch.search.SearchService.parseSource(SearchService.java:838)
    ... 12 more

---

有人知道这意味着什么以及我应该如何解决吗？

确切的错误是，

字段数据加载被禁止在[Hostname]

上，这意味着

Hostname

可能是一个已分析的字段，或者

fielddata

被显式禁用（如果使用它，这是Logstash 2.1中的默认设置）。你能用你的地图更新你的问题吗？哦，这给了我一个提示。我发现Hostname.raw是一种解决问题的方法。谢谢。是的，如果您有一个

raw

字段，那么它就是用于该目的的字段，您将不会再收到该错误。然而，当我转到原始字段时，它有时会给我以下的另一个错误。这是否意味着我在加载中有太多的数据？EsRejectedExecutionException[拒绝执行org.elasticsearch.transport.TransportService$4@9474a在EsThreadPoolExecutor[search，队列容量=1000，org.elasticsearch.common.util.concurrent上。EsThreadPoolExecutor@1aa8ac1[正在运行，池大小=4，活动线程=4，排队任务=1000，已完成任务=7289]]这仅仅意味着您运行了太多的搜索请求，而您的ES群集无法跟上进度。或者您的查询速度太慢且运行时间太长。确切的错误是，

字段数据加载被禁止在[Hostname]

上，这意味着

Hostname

可能是已分析的字段，或者

fielddata

被显式禁用（如果使用它，这是Logstash 2.1中的默认设置）。你能用你的地图更新你的问题吗？哦，这给了我一个提示。我发现Hostname.raw是一种解决问题的方法。谢谢。是的，如果您有一个

raw

字段，那么它就是用于该目的的字段，您将不会再收到该错误。然而，当我转到原始字段时，它有时会给我以下的另一个错误。这是否意味着我在加载中有太多的数据？EsRejectedExecutionException[拒绝执行org.elasticsearch.transport.TransportService$4@9474a在EsThreadPoolExecutor[search，队列容量=1000，org.elasticsearch.common.util.concurrent上。EsThreadPoolExecutor@1aa8ac1[正在运行，池大小=4，活动线程=4，排队任务=1000，已完成任务=7289]]这仅仅意味着您运行了太多的搜索请求，而您的ES群集无法跟上进度。或者查询速度太慢，运行时间太长。