Filebeat can't load template due to circuitbreaker

I'm upgrading elasticsearch/filebeat from 6.5.2 to 7.3.0

filebeat is failing to start with this error:

Error loading Elasticsearch template: could not load template. Elasticsearch returned: couldn't load template: couldn't load json. Error: 429 Too Many Requests: {"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1005387694/958.8mb], which is larger than the limit of [1003493785/957mb], real usage: [1005306456/958.7mb], new bytes reserved: [81238/79.3kb], usages [request=0/0b, fielddata=0/0b, in_flight_requests=81238/79.3kb, accounting=88508810/84.4mb]","bytes_wanted":1005387694,"bytes_limit":1003493785,"durability":"PERMANENT"}]

Full error message which shows a massive template being uploaded:

I tried increasing swap on the ES box, and increasing java -Xmx/-Xms

Is this somehow due to using setup.template.append_fields? It was working fine in 6.5.2

Had to upgrade filebeat to 6.7.2 before upgrading to 7.3.0

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.