Fielddata is disabled on [host.name] in [metricbeat-8.10.3]

[efrainMZ (Efrain Martinez Cuate)]

Hello good morning!

I am ingesting data from metricbeat to elasticsearch and loading the dashboards of version metricbeat 8.10.3 with the command "./metricbeat setup --dashboard" but when viewing the dashboards it shows a warning:

Shard
0
Index
metricbeat-8.10.3-2023.11.29
Type
illegal_argument_exception
Node
TzlnKYr2SluYz1O-f9M8lg
Reason
Fielddata is disabled on [host.name] in [metricbeat-8.10.3-2023.11.29]. Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

But when I see my template the value "host.name" is keyword, I loaded the template with the command "./metricbeat setup --index-management"

aid please

[stephenb (Stephen Brown)]

Hi @efrainMZ

Delete the index ... metricbeat-8.10.3-2023.11.29

then run

./metricbeat setup -e

Pro-Tip : Always run ./metricbeat setup -e not --dashboards or --index-management etc.... just run without the parameters so all assets get loaded.

Then start metricbeat again.

[efrainMZ (Efrain Martinez Cuate)]

Hi Stephenb!

I performed the steps you suggested but I receive the same error when entering the dashboard again:

Shard
0
Index
metricbeat-8.10.3-2023.11.29
Type
illegal_argument_exception
Node
L9pncMC4QeSlR85fKLS9eQ
Reason
Fielddata is disabled on [host.name] in [metricbeat-8.10.3-2023.11.29]. Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

Delete the index and then run the command "./metricbeat setup -e", do you have any other reason?

The version of my metricbeat is 8.10.3

[stephenb (Stephen Brown)]

When I see this... there is something else writing to that index before you run setup

did you stop ALL the metricbeats?

Also you can check in Kibana Dev Tools

GET metricbeat-8.10.3-2023.11.29/_mapping/field/host.name

Should look something like

{
  "metricbeat-8.10.3-2023.11.29": {
    "mappings": {
      "host.name": {
        "full_name": "host.name",
        "mapping": {
          "name": {
            "type": "keyword",
            "ignore_above": 1024
          }
        }
      }
    }
  }
}

[efrainMZ (Efrain Martinez Cuate)]

If I stopped all metricbeat and run the command "./metricbeat setup -e".
Use dev tools as requested to perform the query and this is the result:

{
  "metricbeat-8.10.3-2023.11.30": {
    "mappings": {
      "host.name": {
        "full_name": "host.name",
        "mapping": {
          "name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}

Something strange that I saw is that when creating the template I could see that it has two hostname attributes but named differently, I attach an image

[stephenb (Stephen Brown)]

@efrainMZ

Something strange that I saw is that when creating the template I could see that it has two hostname attributes but named differently, I attach an image

That has been around for a long time... that is normal.

@efrainMZ

{
  "metricbeat-8.10.3-2023.11.30": {
    "mappings": {
      "host.name": {
        "full_name": "host.name",
        "mapping": {
          "name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256

I am not sure why you are seeing that

Go to the next step 4 and see the mappings for those fields in the template...

You are somehow still getting a default mapping...

[efrainMZ (Efrain Martinez Cuate)]

I don't know why it loads the template like this. I show you the mapping in step 4, I attach the image

[stephenb (Stephen Brown)]

That picture looks correct in the template... Not sure why your templates not being applied

It is saying both these are keyword

host.name
host.hostname

Which is correct.

I would delete the templates, delete the indices, delete everything and try setup one more time.
There's something fundamental going on..

[efrainMZ (Efrain Martinez Cuate)]

Returns the fields "host.name" and "host.hostname" as keyword, I did not modify that part. I have tried to eliminate indexes and templates but it has not worked.