FileBeat file type is not correctly set system-wide

Elastic Stack Beats
1

I have trouble to set the file type of field via filebeat.

Somehow the file type is keyword in the Index Pattern overview
image

But in mappings tab of the Index management it says
image

What is the type of the field now?

This is how I set the long type in filebeat:

  - dissect:
      tokenizer: '"%{licence}","%{system}","%{part}","%{uses|integer}","%{users|integer}"'
      field: "message"
      target_prefix: "data"
2

Hi @kwoxer!

I'm not sure if what you see is correct. Since you set the type to integer why it is long in the mapping? Maybe something goes wrong?

If we verify that Filebeat sets the mapping properly then we can ask for help in Kibana's forum to check what goes wrong with the index-template. But for now let's verify that what is set by Filebeat is correct.

3

It seemed to be a caching issue.

Now it says

image

So solution is to wait an hour.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.