<p dir="auto"><strong>Elasticsearch version</strong>: 2.3.1</p>
<p dir="auto"><strong>JVM version</strong>:</p>
<blockquote>
<p dir="auto">[gsmith@crowley ~ ] &gt; java -version<br>
java version "1.8.0_45"<br>
Java(TM) SE Runtime Environment (build 1.8.0_45-b14)<br>
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)</p>
</blockquote>
<p dir="auto"><strong>OS version</strong>: OS X 10.10.5</p>
<p dir="auto"><strong>Description of the problem including expected versus actual behavior</strong>:</p>
<p dir="auto">Response to <code class="notranslate">_cat/fielddata</code> when there is an actual "ip" field in the indexed data reports the IP address of the node in the column where the size of fielddata used by the "ip" field should appear.</p>
<p dir="auto"><strong>Steps to reproduce</strong>:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="#0. Delete the index
DELETE test_field_data
#1. Create the index with a document:
POST test_field_data/test_field_data
{&quot;reason&quot;: &quot;something is off&quot;, &quot;ip&quot;: &quot;192.168.1.0&quot;}
#2. Flush
POST _flush
#3. Perform a search that loads fielddata
GET test_field_data/_search
{
  &quot;query&quot;: {
    &quot;match_all&quot;: {}
  },
  &quot;aggs&quot;: {
    &quot;ip&quot;: {
      &quot;terms&quot;: {
        &quot;field&quot;: &quot;ip&quot;,
        &quot;size&quot;: 10
      }
    },
    &quot;reason&quot;: {
      &quot;terms&quot;: {
        &quot;field&quot;: &quot;reason&quot;,
        &quot;size&quot;: 10
      }
    }
  }
}
#4. Inspect the fielddata
GET _cat/fielddata/ip,reason?v"><pre class="notranslate"><code class="notranslate">#0. Delete the index
DELETE test_field_data
#1. Create the index with a document:
POST test_field_data/test_field_data
{"reason": "something is off", "ip": "192.168.1.0"}
#2. Flush
POST _flush
#3. Perform a search that loads fielddata
GET test_field_data/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "ip": {
      "terms": {
        "field": "ip",
        "size": 10
      }
    },
    "reason": {
      "terms": {
        "field": "reason",
        "size": 10
      }
    }
  }
}
#4. Inspect the fielddata
GET _cat/fielddata/ip,reason?v
</code></pre></div>
<p dir="auto">The return looks like:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="id                     host      ip        node total reason ip        
FNsjPCVATN-xsg7O0vxIuQ 127.0.0.1 127.0.0.1 only 2.8kb   488b 127.0.0.1 "><pre class="notranslate"><code class="notranslate">id                     host      ip        node total reason ip        
FNsjPCVATN-xsg7O0vxIuQ 127.0.0.1 127.0.0.1 only 2.8kb   488b 127.0.0.1 
</code></pre></div>
<p dir="auto">I have also seen a response from a 3 node cluster, also v 2.3.1, where two of the nodes are reported as shown above, and the third node actually has the fielddata usage reported, both in the correct place and in the column where the node ip address is supposed to appear.</p>
<p dir="auto">If you have <code class="notranslate">minimum_master_nodes</code> set and you don't supply enough nodes in <code class="notranslate">d.z.p.unicast.hosts</code>, a node can fail to join the cluster. Described at <a href="http://thread.gmane.org/gmane.comp.search.elasticsearch.user/740" rel="nofollow">http://thread.gmane.org/gmane.comp.search.elasticsearch.user/740</a>.</p>