Error after 5.x to 6.4.3 upgrade

Elastic Stack Beats
1

I am upgrading Elasticsearch and all components, but running into issues with Metricbeat.

Error:

2018-11-10T21:32:13.652+0100 WARN elasticsearch/client.go:520 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbef1edf3257fa0f8, ext:40040976916, loc:(*time.Location)(0x37e0b20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"apache":common.MapStr{"status":common.MapStr{"total_accesses":11972720, "requests_per_sec":9.79804, "cpu":common.MapStr{"children_system":1.78, "load":0.51621, "user":5223.07, "system":1060.44, "children_user":22.54}, "load":common.MapStr{"5":0.22, "15":0.19, "1":0.2}, "bytes_per_request":47139.2, "scoreboard":common.MapStr{"open_slot":153, "reading_request":0, "closing_connection":0, "gracefully_finishing":0, "waiting_for_connection":45, "starting_up":0, "keepalive":0, "logging":0, "idle_cleanup":0, "total":200, "dns_lookup":0, "sending_reply":2}, "bytes_per_sec":461872, "workers":common.MapStr{"busy":2, "idle":45}, "total_kbytes":551156649, "uptime":common.MapStr{"server_uptime":1221951, "uptime":1221951}, "connections":common.MapStr{"async":common.MapStr{}}, "hostname":"127.0.0.1"}}, "beat":common.MapStr{"name":"server", "hostname":"server", "version":"6.4.3"}, "host":common.MapStr{"name":"server"}, "metricset":common.MapStr{"host":"127.0.0.1", "rtt":1455, "name":"status", "module":"apache"}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [system] has unsupported parameters: [properties : {ticks={type=long}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [system] has unsupported parameters: [properties : {ticks={type=long}}]"}}

I'm guessing the relevant part is this

"reason":"Mapping definition for [system] has unsupported parameters: [properties : {ticks={type=long}}]"

In an effort to solve this I have tried deleting all old metricbeat indexes and templates. Completely removed and purged old metricbeat installation, changing only ES host and activating apache module in this case. A new metricbeat-6.4.3 template is created but no index.

Outputting to flat file works, so the issue is writing to ES.

I thought the problem might be with the "system" module, but disabling it has no effect.

2

Hi @mpaulsen and welcome :slight_smile:

This seems to be a similar issue to the one mentioned in this topic, take a look to it, but in summary it can be that you have an old unversioned index template (that should be fixed by deleting it with DELETE _template/metricbeat).

If that's not the case, it still seems that you could have some problem with index template patterns, review its configuration of you are modifying them.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.