Elastic Transform Error

[IWannaDance (Alex Wang)]

[ERROR][o.e.x.t.t.TransformPersistentTasksExecutor] [node-1] Failed to start task [endpoint.metadata_current-default-0.19.1] in node operation org.elasticsearch.ElasticsearchStatusException: Unable to start transform [endpoint.metadata_current-default-0.19.1] as it is in a failed state with failure: [Failed to gather field mappings for index [metrics-endpoint.metadata_current_default]]. Use force stop and then restart the transform once error is resolved.

I get the following error when I start up elasticsearch locally. This doesn't stop elasticsearch from starting running though. I couldn't find anything about this error and don't know what it is, so if anyone knows any information about this please let me know.

[Kevin_Logan]

@IWannaDance

This error is coming from the ES components installed by the Endpoint package, namely a transform. When starting up, transforms gather field mappings from its destination index. If it fails at gathering these mappings, it won't know how to map data from its aggregation. We're tracking the issue here: [Security Solution] Endpoint metadata Transform failed due to failure to gather field mappings · Issue #104624 · elastic/kibana · GitHub

You can read more about Transforms here: Transforming data | Elasticsearch Guide [7.13] | Elastic

This error will only affect you if you're using Endpoint security. If you are, you can work around this through the Kibana UI.

The Endpoint security Administration page requires that an ES transform runs in the background. It should have been installed for you - can you verify that you have a transform named similarly to endpoint.metadata_current-default-<version>?

You can do this in the UI by navigating to "Stack Management > Transforms"

You should see something like this:

If by chance there is a Transform and it's stopped, you can start it like this:

You may see a similar error in the Messages tab like this: