Filebeat warning log "Cannot index event"

Elastic Stack Elasticsearch
1

When sending logs from Filebeat to Elasticsearch, when there is an indexing error, Filebeat will log the message

Cannot index event (status=400): dropping event! Look at the event log to view the event and cause."

The log doesn't show "reason" or "caused_by".

When I use Elastic Agent, this error shows more details, including "reason" and "caused_by".

Is there a way to achieve the same with Filebeat?

2

Hi @rodolk Welcome to the community!

You can turn on logging debug and see.... Are you sure there isn't a following line with the mapping conflict, perhaps that is now logged at debug level

It is often a mapping issue ... The document being written has a mapping conflict.

What version are you on?