Auditbeat template - no fielddata allowed?

Elastic Stack Beats
1

Im using 7.5.2 across the board. I installed the auditbeat vis and dashboards but when I go to the 'logins' view I get a message

Fielddata is disabled on text fields by default. Set fielddata=true on [event.action] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

So I get the auditbeat 7.5.2 template and look at the properties for 'event.action' . First I notice that its already a 'keyword' field. Mmmk. So I try to add 'fieldata':'true' and Im told

"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [_doc]: Mapping definition for [action] has unsupported parameters: [fielddata : true]",

Seems like a disconnect here. How do I rectify this?

2

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.