After setting up ELK 7.3.1 according to ELK Tutorial :
https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-elastic-stack.html
and looking in to this dashboard:
"[Metricbeat System] Overview ECS", I got several errors in the dashboard , e.g.: wrong indication of "Number of hosts [Metricbeat System] ECS" = 0 or other errors, see screenshot below. . Looking into elasticsearch logfile I see the message:
" org.elasticsearch.transport.RemoteTransportException: [8c0c66034037][172.22.0.5:9300][indices:data/read/search[phase/query]]
Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
when i try to fix this using this by setting "fielddata=true" according to this description: https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html
i.e. :
PUT metricbeat*/_mapping
{
"properties": {
"host.name": {
"type": "text",
"fielddata": true
}
}
}
all i get is another error:
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Types cannot be provided in put mapping requests, unless the include_type_name parameter is set to true."
}
],
"type": "illegal_argument_exception",
"reason": "Types cannot be provided in put mapping requests, unless the include_type_name parameter is set to true."
},
"status": 400
}
now I'm lost.
The only workaround I found , was to manually change lots of fieldnames in all visualizations of the dashboard:
e.g. change in visualisation "Number of hosts" the fieldname from "host.name" to "host.name.keyword"
this is however very tedious. Since there are about 10 shards to change, everytime I setup a new ELK-Stack.
