APM Span mappings keep getting back to defaults

Elastic Observability APM
1

Hi!, I'm running the ElasticStack v7.11.1. Lately I had the need to start indexing a couple of request header values that came to some APM logs I'm collecting.
To do that I had to mark the http.request.headers object as searchable. I did, then lifecycled the index and all good.
Couple of days later that change was gone.. tried again thinking that I might have done something wrong the first time, same thing.
Something keeps refreshing the apm-* mapping to its default state, could it be the apm-server doing this?

Thanks.
Rodrigo.

2

Do you have template overwrite enabled (with setup.template.overwrite)? If so, you'll want to set setup.template.append_fields. You probably want that anyway so the setting is retained as you upgrade APM Server.

3

Hi! Thanks for checking this question, but, the config for the apm server is pretty default.

# Overwrite existing template.
#setup.template.overwrite: false

:frowning:

4

To add some extra data, this is what I'm seeing:

image
image686×739 35.1 KB

image
image869×743 54.7 KB

The "searchable" flag, keeps getting disabled (after an index lifecycle event)