Hi!, I'm running the ElasticStack v7.11.1. Lately I had the need to start indexing a couple of request header values that came to some APM logs I'm collecting.
To do that I had to mark the http.request.headers object as searchable. I did, then lifecycled the index and all good.
Couple of days later that change was gone.. tried again thinking that I might have done something wrong the first time, same thing.
Something keeps refreshing the apm-* mapping to its default state, could it be the apm-server doing this?
Do you have template overwrite enabled (with setup.template.overwrite)? If so, you'll want to set setup.template.append_fields. You probably want that anyway so the setting is retained as you upgrade APM Server.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.