Filebeat in kubernetes can't create index

[McElroy (Andreas Wachter)]

Hi,

I tried to run filebeat in docker/kubernetes according to this documentation:

Shipping Kubernetes logs with Filebeat

But everything I get is:

2018/03/19 14:26:15.109861 client.go:465: WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [default]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, type={ignore_above=1024, type=keyword}, message={norms=false, type=text}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, type={ignore_above=1024, type=keyword}, message={norms=false, type=text}}]"}}

Why? And what do I have to do to make it work?

[ruflin]

The above error seems like a conflict between different versions of the Filebeat template. Which version of Filebeat are you using? Can you share your config (did you modify the index pattern)? Also do you have multiple versions of Filebeat running?

If you have the option to start fresh, remove the template and the most recent index, then Filebeat should recreate everything fresh I would expect it to work.

[McElroy (Andreas Wachter)]

Hi,

Thank you very much. I could solve it already. I deleted the old templates, used the the right filebeat container and voila it worked.

But I ditched the solution shortly after and build a new elasticsearch cluster with the newest version in docker. So I could use the docu.

Anyway thanks for the help.