. Response: {"statusCode":403,"error":"Forbidden","message":"Unable to bulk_create index-pattern"}
```
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [March 6, 2023, 11:01pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/7 "2023-03-06T23:01:30Z")
These are the privileges given to the `filebeat_writer` role. I'm assuming this is the user/role invoked with `setup`
And the full output from `filebeat setup -e`
> **[2023-03-06T14:56:59.035-0800 INFO instance/beat.go:697 Home path:...](https://pastebin.com/j5Qn3dKN)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 6, 2023, 11:08pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/8 "2023-03-06T23:08:29Z")
The setup Role is different... I did not understand that you did not have a setup role, the writer roles does not have the needed to do all the kibana stuff but that is really not needed.
Loading index pattern does not really matter...
```auto
2023-03-06T14:45:05.077-0800 INFO template/load.go:123 Template with name "filebeat-7.17.8" loaded.
2023-03-06T14:45:05.077-0800 INFO [index-management] idxmgmt/std.go:297 Loaded index template.
2023-03-06T14:45:05.077-0800 INFO [index-management.ilm] ilm/std.go:108 Index alias is not checked as setup.ilm.check_exists is disabled
Index setup finished.
```
`Loaded index template.` \<\<\< This is what is important.
That should be enough did you check the loaded template and see if the new field is there?
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [March 6, 2023, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/9 "2023-03-06T23:12:49Z")
> [@stephenb](#):
>
> check the loaded template
Do I do that the same way I showed above? Like this:
```auto
GET filebeat-7.17.8/_mapping/field/user_agent.version
GET filebeat-7.17.9/_mapping/field/user_agent.version
```
They are still showing the same thing.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 6, 2023, 11:40pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/10 "2023-03-06T23:40:06Z")
Ohh darn I did not look at the fields closely I do not think that will work ... let me look and get back with a better answer.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 7, 2023, 12:13am UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/11 "2023-03-07T00:13:00Z")
Ok `user_agent.version` is already a defined field / mapping so no need to edit the fields.
What this tells me is that you have not been running `filebeat setup -e` which sets up the templates and that is most likely your issue.
To see the current mapping look at
`curl localhost:9200/_index_template/filebeat-7.17.3`
It easier is to use `jq`
```auto
curl localhost:9200/_index_template/filebeat-7.17.3 | jq '[.index_templates[].index_template.template.mappings.properties.user_agent]'
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 343k 100 343k 0 0 10.7M 0 --:--:-- --:--:-- --:--:-- 13.9M
[
{
"properties": {
"original": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"os": {
"properties": {
"full_name": {
"ignore_above": 1024,
"type": "keyword"
},
"kernel": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"family": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"platform": {
"ignore_above": 1024,
"type": "keyword"
},
"full": {
"ignore_above": 1024,
"type": "keyword",
"fields": {
"text": {
"type": "match_only_text"
}
}
}
}
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"device": {
"properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
]
```
I think you are not running setup, did you run setup before?
so now to get a new index with the right mapping _ **after** _ you see the right mapping is
`POST filebeat-7.17.9/_rollover`
Then try
```auto
$ curl localhost:9200/filebeat-7.17.9/_mapping/field/user_agent.version | jq % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 169 100 169 0 0 18049 0 --:--:-- --:--:-- --:--:-- 84500
{
"filebeat-7.17.9-2023.03.06-000001": {
"mappings": {
"user_agent.version": {
"full_name": "user_agent.version",
"mapping": {
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
}
}
```
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [March 7, 2023, 2:01pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/12 "2023-03-07T14:01:19Z")
Thank you for all the help here. I think we have come full circle to what I noted when I opened this issue (see above). That is, I have two indices `filebeat-7.17.8` and `filebeat-7.17.9`. Below is what I'm seeing for the mappings. I have not applied any `POST` or `PUT` against either index. In fact, the only potentially invasive thing I've done since working on this is running `filebeat setup` as noted earlier in this discussion.
You asked:
> did you run setup before?
...and I'm unsure. I'm looking at some notes from a previous engineer and I see this was installed via Ansible and it's noted "Filebeat can create the index." Until I have time to look at the Ansible code I'll assume `filebeat setup` may not have occurred when this elasticsearch became operational.
Does this issue reflect the lack of loading the "[recommended index template](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html#setup-assets)?"
As this has been very time consuming and complex, all for remedying what may have been an improper installation, I'm considering dropping the indices and starting over. I can't find a document that guides this but I'm assuming it could be accomplished by just deleting each index. Do you have anything to recommend for this course? Would you advise against it?
* * *
```auto
# curl -s --user elastic:foobar https://elasticsearch.vvv.io:9200/filebeat-7.17.8/_mapping/field/user_agent.version | jq
{
"filebeat-7.17.8": {
"mappings": {
"user_agent.version": {
"full_name": "user_agent.version",
"mapping": {
"version": {
"type": "date"
}
}
}
}
}
}
```
```auto
# curl -s --user elastic:foobar https://elasticsearch.vvv.io:9200/filebeat-7.17.9/_mapping/field/user_agent.version | jq
{
"filebeat-7.17.9": {
"mappings": {
"user_agent.version": {
"full_name": "user_agent.version",
"mapping": {
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 7, 2023, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/13 "2023-03-07T14:43:29Z")
Hi @mevan
Apologies, but I do not know how you got in this configuration in the first place.
So yes, if the data is not important I would delete both of those indices and start over.
Neither of those mappings are correct.
Also, are you using the nginx module? Hopefully you are.
I would clean up those indices and then I would follow the [quick start guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html) and follow those steps.
That probably would have helped you get started in the correct way in the first place.
That quick start guide example even uses the nginx module
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 4, 2023, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-field-user-agent-version-of-type-date/327124/14 "2023-04-04T14:43:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.