Field [@timestamp] of type [keyword] does not support custom time zones

Once I set packetbeat to use fields.yml I get following exception in elastic logs and on kibana dashboard.

Caused by: java.lang.IllegalArgumentException: Field [@timestamp] of type [keyword] does not support custom time zones

How can I fix this?

That's the default behavior when using the ES output. Can you please elaborate on what you changed? The error you are reporting most likely means that there's a problem with your index template (either one is not installed or it has the wrong type for @timestamp).

You can check if the index template is installed by requesting GET _template/filebeat* from ES and checking that the template for your Filebeat version is installed and that it has an index_patterns field that match your index naming strategy.

You can also check how @timestamp is mapped for a particular index with GET filebeat-*/_mapping/field/@timestamp.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.