Since today at 2am my filebat was working well, now I got no more data and the following error messages:
2016-09-22T11:53:04+02:00 WARN Can not index event (status=400): "MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [hostname]]; "
2016-09-22T11:53:26+02:00 INFO Non-zero metrics in the last 30s: libbeat.es.publish.read_bytes=873 registar.states.total=2 filebeat.harvester.started=1 libbeat.es.publish.write_bytes=1411
libbeat.es.call_count.PublishEvents=1 filebeat.harvester.running=1 publish.events=2 registrar.state_updates=2 libbeat.es.published_and_acked_events=1 libbeat.publisher.published_events=1 filebeat.harvester.open_files=1
Filebeat 5.x automatically installs the template and picks the right one for the elasticsearch version. I think what solved the problem is that you removed the index template (not only the index).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.