I upgraded from 8.3.1 to 8.3.2 and now I get an error when I access a geo map in kibana with the message: 1 of 2 shards failed
the detailed information is
"index": "filebeat-8.3.2",
"reason": {
"type": "illegal_argument_exception",
"reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [bind9.geo.country_iso_code] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
In version 8.3.1 I created a new module in filebeat with name "bind9".
In manifest I defined
Look like the default Logstash/Elasticsearch mappings, rather than mappings provided by Filebeat (note: I didn't check the source code of Filebeat 8.3.2, so it is possible that a mapping bug made its way through)
Hi, before I run an upgrade I stop complete ELK stack. Also remote filebeat. Do the upgrade, start Elasticsearch and kibana. Manually I post a single doc to load the index because I have to define a lot of fields before I start all filebeats ( the local and remote ) Definitely there was a lot of time before data from filebeat was coming.
I am wondering there is a datastream only for version 8.3.1 but not for 8.3.2 ( for all beats ). But there are index templates for 8.3.1 and 8.3.2
Is this normal ? Can I test something ?
There are different index templates for 8.3.1 and 8.3.2, you need to load the index templates & create the matching data stream (this can be done with via the normal Filebeat setup proceedure after an upgrade), before creating docs. If you just create a doc without doing the above, it will just create a default index with the default mappings, which isn't what you want.
You can check this by looking at the index template loaded into the Elasticsearch instance to see if there is an 8.3.2 index template. Then you can check to see if there is a properly created data stream for Filebeat 8.3.2 (in 8.x beats switched from using a standard index to using a data stream)
If the above 2 things aren't there, then you probably need to go back and run the Filebeat setup for 8.3.2 (you might need to delete the existing 8.3.2 index if one exists as you can't have a data stream with the same name as an index; Warning: Deleting an index will cause the data on it to be deleted, be sure to have a backup of it, if you don't want to lose the data.)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.