Hi,
I just enabled and started filebeat with 2 modules (system and auditd) and
my index (filebeat-*) is not created/populated in elasticsearch.
Filebeat config:
filebeat.config.modules.path: ${path.config}/modules.d/*.yml
output.elasticsearch:
hosts: ["HOSTNAME"]
Filebeat.logs
2018-07-24T17:24:07.954+0200 WARN elasticsearch/client.go:502 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbecdef05b7e73fb8, ext:606069906850, loc:(*time.Location)(0
x1f4a300)}, Meta:common.MapStr{"pipeline":"filebeat-6.3.1-system-syslog-pipeline"}, Fields:common.MapStr{"source":"/var/log/messages", "offset":551245, "message":"Jul 24 17:24:01 HOSTNAME systemd: Starting
Session 76334 of user root.", "prospector":common.MapStr{"type":"log"}, "input":common.MapStr{"type":"log"}, "fileset":common.MapStr{"module":"system", "name":"syslog"}, "beat":common.MapStr{"name":"HOSTNAME", "hostname":"HOSTNAME", "version":"6.3.1"}, "host":common.MapStr{"name":"HOSTNAME"}}, Private:file.State{Id:"", Finished:false, Fileinfo:(*os.fileStat)(0xc4201b61a0), Source:"/v
ar/log/messages", Offset:551321, Timestamp:time.Time{wall:0xbecdee6e36f76164, ext:54186594, loc:(*time.Location)(0x1f4a300)}, TTL:-1, Type:"log", Meta:map[string]string{}, FileStateOS:file.StateOS{Inode:0xf482f,
Device:0x802}}}, Flags:0x1} (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long},
message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {co
de={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}
Mapping template is created
filebeat export template > filebeat.template.json
curl -X PUT "HOSTNAME/_template/filebeat" -H 'Content-Type: application/json' -d@filebeat.template.json