Variable Issue after upgrade to Elasticsearch 7.1 - Query finds no values - Solved

I have a simple dashboard that pulls a hostname as a variable from an Elastic Index. This used to work on Elastic 6.7, but i’ve had a number of issues since upgrading to 7.1. I’ve upgraded Grafana to 6.3.0 and my datasource looks ok. It gets Index OK, Time field name OK when I save and test it.

My problem now is that the variables on the dashboard don’t find any results. There is no error.

If I hardcode the into a panel then it works as expected (i.e. it finds the value and displays it correctly on the graph.)

Here is some example data from within the specified index.

Can anyone explain why the variable preview finds no values? Has the syntax changed or have I missed something obvious!?


Have you changed version in datasource configuration to 7.0+?

Yes datasource is set to 7.0+.

  1. Please make sure that you’re using a time range in dashboard that has terms
  2. Use chrome developer tools and check the console for errors and network tab _msearch request/response of your terms variable query.

Ok that was helpful thanks.

I could see the below error

“Fielddata is disabled on text fields by default. Set fielddata=true on [] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.”

Setting fielddata to true does fix the problem. On a side note this index is the default one that metricbeat 7.1 creates. I’m not sure if changing this setting won’t have other implications. It might need some tweaking!

Thanks again.