# Issue with message field data

**URL:** <https://forum.opensearch.org/t/issue-with-message-field-data/13420>\
**Category:** OpenSearch\
**Created:** [March 20, 2023, 7:17pm UTC](https://forum.opensearch.org/t/issue-with-message-field-data/13420 "2023-03-20T19:17:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xuupu](https://avatars.discourse-cdn.com/v4/letter/x/b3f665/32.png) [@Xuupu](https://forum.opensearch.org/u/Xuupu)\
**Post date:** [March 20, 2023, 7:17pm UTC](https://forum.opensearch.org/t/issue-with-message-field-data/13420/1 "2023-03-20T19:17:47Z")

</div>

Hello!

I do have a question about this error I do have :

2023-03-20T15:16:32.387-04:00 ERROR [PivotAggregationSearch] Aggregation search query returned an error: OpenSearch exception [type=illegal\_argument\_exception, reason=Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [message] in order to load field data by uninverting the inverted index. Note that this can use significant memory.].

I recently change ElasticSearch to Opensearch 2.6, i’ve tried to change into the API the fielddata to put yes. Nothing change, I still have the error.

---

<div class="post-metadata">

**Author:** ![gaobinlong](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gaobinlong/32/5242_2.png) [@gaobinlong](https://forum.opensearch.org/u/gaobinlong)\
**Post date:** [March 28, 2023, 8:48am UTC](https://forum.opensearch.org/t/issue-with-message-field-data/13420/2 "2023-03-28T08:48:34Z")

</div>

How did you set `fielddata` to `true` for the field `message`? I’ve tried updating the mapping and it works:

```auto
PUT test1/_mapping
{
  "properties": {
      "message":{
        "type":"text",
        "fielddata":true
      }
    }
}

```

---

<div class="post-metadata">

**Author:** ![radu.gheorghe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/radu.gheorghe/32/3516_2.png) [@radu.gheorghe](https://forum.opensearch.org/u/radu.gheorghe)\
**Post date:** [March 30, 2023, 7:58am UTC](https://forum.opensearch.org/t/issue-with-message-field-data/13420/3 "2023-03-30T07:58:04Z")

</div>

Let me also expand on:

> Note that this can use significant memory

Fielddata will un-invert your inverted index for that field and store the result in memory, as a mapping between document IDs and terms. So if you have a lot of data (e.g. logs or other use-cases with millions to billions of documents) you might bump into some circuit breaker (fielddata or parent) or cause instability in the cluster.

Even if you don’t have a lot of data, this structure has to be built from scratch after every refresh on the first query, so that query will have quite a delay. It’s also going to build it for all the data in that field, even if that first query only returns two documents.

The usual practice is to use doc\_values for aggregations. But this doesn’t work for text fields, it works for keyword fields instead. But this means you don’t get analysis (i.e. breaking the text into tokens). For that, some people break the text into tokens in the pipeline, before indexing data into Elasticsearch, then index it as an array of “keywords”. I know it’s not apples-to-apples, but I’m venting some ideas 🙂