Elasticsearch: Field data loading is forbidden on [geoip.city_name]

最近在做es相关的内容，聚合查询的时候，出现以下异常：

Exception in thread "main" Failed to execute phase [query], all shards failed; shardFailures {[npUSie-VRI20r03HsY36Ow][logstash-tomcat_access_log][0]: RemoteTransportException[[Crimson and the Raven][192.168.0.153:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":{"match":{"method":{"query":"POST","type":"boolean"}}}}},"aggregations":{"geoip.city_name":{"terms":{"field":"geoip.city_name"}}}}]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]]; }{[npUSie-VRI20r03HsY36Ow][logstash-tomcat_access_log][1]: RemoteTransportException[[Crimson and the Raven][192.168.0.153:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":{"match":{"method":{"query":"POST","type":"boolean"}}}}},"aggregations":{"geoip.city_name":{"terms":{"field":"geoip.city_name"}}}}]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]]; }{[npUSie-VRI20r03HsY36Ow][logstash-tomcat_access_log][2]: RemoteTransportException[[Crimson and the Raven][192.168.0.153:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":{"match":{"method":{"query":"POST","type":"boolean"}}}}},"aggregations":{"geoip.city_name":{"terms":{"field":"geoip.city_name"}}}}]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]]; }{[npUSie-VRI20r03HsY36Ow][logstash-tomcat_access_log][3]: RemoteTransportException[[Crimson and the Raven][192.168.0.153:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":{"match":{"method":{"query":"POST","type":"boolean"}}}}},"aggregations":{"geoip.city_name":{"terms":{"field":"geoip.city_name"}}}}]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]]; }{[npUSie-VRI20r03HsY36Ow][logstash-tomcat_access_log][4]: RemoteTransportException[[Crimson and the Raven][192.168.0.153:9300][indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query":{"bool":{"must":{"match":{"method":{"query":"POST","type":"boolean"}}}}},"aggregations":{"geoip.city_name":{"terms":{"field":"geoip.city_name"}}}}]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]]; }at org.elasticsearch.action.search.AbstractSearchAsyncAction.onFirstPhaseResult(AbstractSearchAsyncAction.java:206)at org.elasticsearch.action.search.AbstractSearchAsyncAction$1.onFailure(AbstractSearchAsyncAction.java:152)at org.elasticsearch.action.ActionListenerResponseHandler.handleException(ActionListenerResponseHandler.java:46)at org.elasticsearch.transport.TransportService$DirectResponseChannel.processException(TransportService.java:855)at org.elasticsearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:833)at org.elasticsearch.transport.TransportService$4.onFailure(TransportService.java:387)at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:39)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)at java.lang.Thread.run(Thread.java:722)Caused by: NotSerializableExceptionWrapper[: Field data loading is forbidden on [geoip.city_name]]; nested: IllegalStateException[Field data loading is forbidden on [geoip.city_name]];at org.elasticsearch.ElasticsearchException.guessRootCauses(ElasticsearchException.java:386)at org.elasticsearch.action.search.SearchPhaseExecutionException.guessRootCauses(SearchPhaseExecutionException.java:152)at org.elasticsearch.action.search.SearchPhaseExecutionException.getCause(SearchPhaseExecutionException.java:99)at org.elasticsearch.ElasticsearchException.writeTo(ElasticsearchException.java:226)at org.elasticsearch.action.search.SearchPhaseExecutionException.writeTo(SearchPhaseExecutionException.java:64)at org.elasticsearch.common.io.stream.StreamOutput.writeThrowable(StreamOutput.java:564)at org.elasticsearch.ElasticsearchException.writeTo(ElasticsearchException.java:226)at org.elasticsearch.transport.ActionTransportException.writeTo(ActionTransportException.java:64)at org.elasticsearch.common.io.stream.StreamOutput.writeThrowable(StreamOutput.java:564)at org.elasticsearch.transport.netty.NettyTransportChannel.sendResponse(NettyTransportChannel.java:120)at org.elasticsearch.transport.DelegatingTransportChannel.sendResponse(DelegatingTransportChannel.java:68)at org.elasticsearch.transport.RequestHandlerRegistry$TransportChannelWrapper.sendResponse(RequestHandlerRegistry.java:146)at org.elasticsearch.action.support.HandledTransportAction$TransportHandler$1.onFailure(HandledTransportAction.java:74)at org.elasticsearch.action.search.AbstractSearchAsyncAction.raiseEarlyFailure(AbstractSearchAsyncAction.java:294)... 10 moreCaused by: java.lang.IllegalStateException: Field data loading is forbidden on [geoip.city_name]at org.elasticsearch.index.fielddata.IndexFieldDataService$1.build(IndexFieldDataService.java:74)at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:275)at org.elasticsearch.search.aggregations.support.ValuesSourceParser.config(ValuesSourceParser.java:209)at org.elasticsearch.search.aggregations.bucket.terms.TermsParser.parse(TermsParser.java:76)at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:198)at org.elasticsearch.search.aggregations.AggregatorParsers.parseAggregators(AggregatorParsers.java:103)at org.elasticsearch.search.aggregations.AggregationParseElement.parse(AggregationParseElement.java:60)at org.elasticsearch.search.SearchService.parseSource(SearchService.java:838)at org.elasticsearch.search.SearchService.createContext(SearchService.java:654)at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:620)at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:371)at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33)at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:376)at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)... 3 more

通过对指定field添加.raw解决。 详细原由有待深入研究，先记下来，待后续查看。

参考：

https://github.com/elastic/elasticsearch/issues/15267