ES 2.3 -> 5.x metricbeat index field limit

[gregoryo (Gregory Orange)]

Are you doing any transformations on the logstash side?

No filters, just this in output:

output {
  if [type] == 'metricsets' {
    elasticsearch {
      index => "logstash-metricbeat-%{+xxxx.ww}"
      document_type => "%{[@metadata][type]}"

Do you use daily indices?

Weekly, as you can see above.

Did you load the template into elasticsearch? It is automatically loaded if you send data to elasticsearch.

In short, yes I did, and it's described more here.

Did you use "beta" versions of metricbeat on the same indices?

Since 2 November I've been using a metricbeat that I built myself, at whatever versions of things at that time. I have nothing else in those indices (logstash-metricbeat-2016.{44-47}), and no earlier logstash-metricbeat-* indices. I wonder if it's time to build the binary again from current sources.