ES错误记录

1、Caused by: org.elasticsearch.ElasticsearchException: ElasticsearchException[CircuitBreakingException[[fielddata] Data too large, data for [zone] would be larger than limit of [6390113894/5.9gb]]]; nested: UncheckedExecutionException[CircuitBreakingException[[fielddata] Data too large, data for [zone] would be larger than limit of [6390113894/5.9gb]]]; nested: CircuitBreakingException[[fielddata] Data too large, data for [zone] would be larger than limit of [6390113894/5.9gb]];

原因：由于cache溢出导致
在linux中查看cache大小?
free -hl
buffers(buffer cache), 块设备的缓冲区，协调memory与disk.
cache(page cache), 用于给文件做缓存,记录打开过的文件。协调CPU与memory.

solution:

(1) 手动删除cache:
curl -XPOST '127.0.0.1:9200/_cache/clear'

(2)修改Elasticsearch配置文件
indices.fielddata.cache.size: 20%
当cache达到20%，则自动清理缓存。
indices.fielddata.cache.size默认值为无限大，则esata too large异常。

2、聚合报错，Elasticsearch exception [type=illegal_argument_exception, reason=Fielddata is disabled on text fields by default.

PUT ccmonitorlog/_mapping/logmessage/
{
  "properties": {
    "serviceLine": { 
      "type":     "text",
      "fielddata": true
    }
  }
}