Once I set packetbeat to use fields.yml I get following exception in elastic logs and on kibana dashboard.
Caused by: java.lang.IllegalArgumentException: Field [@timestamp] of type [keyword] does not support custom time zones
How can I fix this?
That's the default behavior when using the ES output. Can you please elaborate on what you changed? The error you are reporting most likely means that there's a problem with your index template (either one is not installed or it has the wrong type for @timestamp).
You can check if the index template is installed by requesting GET _template/filebeat* from ES and checking that the template for your Filebeat version is installed and that it has an index_patterns field that match your index naming strategy.
You can also check how @timestamp is mapped for a particular index with GET filebeat-*/_mapping/field/@timestamp.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.