Hi!, I'm running the ElasticStack v7.11.1. Lately I had the need to start indexing a couple of request header values that came to some APM logs I'm collecting.
To do that I had to mark the http.request.headers object as searchable. I did, then lifecycled the index and all good.
Couple of days later that change was gone.. tried again thinking that I might have done something wrong the first time, same thing.
Something keeps refreshing the apm-* mapping to its default state, could it be the apm-server doing this?
Do you have template overwrite enabled (with
setup.template.overwrite)? If so, you'll want to set
setup.template.append_fields. You probably want that anyway so the setting is retained as you upgrade APM Server.
Hi! Thanks for checking this question, but, the config for the apm server is pretty default.
# Overwrite existing template.
To add some extra data, this is what I'm seeing:
The "searchable" flag, keeps getting disabled (after an index lifecycle event)
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.