Hello,
Since March 20, an error has appeared in the fleet-server logs
{"log.level":"error","@timestamp":"2025-04-23T10:21:12.631Z","message":"Eat bulk checkin error; Keep on truckin'","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"error.message":"elastic fail 400: document_parsing_exception: [1:207] object mapping for [local_metadata] tried to parse field [local_metadata] as object, but found a concrete value","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
and
"message":"Eat bulk checkin error; Keep on truckin'"
and
"error.message": "elastic fail 400: document_parsing_exception: [1:207] object mapping for [local_metadata] tried to parse field [local_metadata] as object, but found a concrete value"
I don't really know where this error comes from. Around March 20, I upgraded the elastic stack version from 8.17.1 to 8.17.3. I also upgraded some agents in the area that day.
For two agents, the upgrade failed and they stayed on 8.17.1. Since then, in the fleet, for the agent that failed to upgrade, there is a message "Agent upgrade is stuck in failed state. Agent upgrade failed. Consider restarting the upgrade."
However, I also checked the message regarding the local_metadata mapping, which is in the .fleet-agents-7 index
for practically all local_metadata some mapping is specified, while for "local_metadata.elastic.agent.complete" there is an "unknown field". When I looked in the data views in management, this field is not there.
And now I wonder if this is a matter of agent upgrade or mapping? This index is without a template and without an ingest pipeline, so as a user I also cannot update the mapping for this field. I get this message:
"action [indices:admin/mapping/put] is unauthorized for user [xxxxxxx.x] with effective roles [admin,editor,monitoring_user,superuser] on restricted indices [.fleet-agents-7], this action is granted by the index privileges [manage,all]"