Fleet-server mapping error in 9.0.2

Elastic Security
1

Self hosted ELK 9.0.2 records this mapping error from fleet-server running on an elastic-cluster-node once per minute:

 "error.message": "elastic fail 400: document_parsing_exception: [1:207] object mapping for [local_metadata] tried to parse field [local_metadata] as object, but found a concrete value"

[...]

    "service.type": [
      "fleet-server"
    ],
    "component.id": [
      "fleet-server-default"
    ],
    "host.os.version": [
      "24.04.2 LTS (Noble Numbat)"
    ],
    "host.os.name": [
      "Ubuntu"
    ],
    "log.level": [
      "error"
    ],
    "agent.name": [
      "srv-elastic01"
    ],
    "host.name": [
      "srv-elastic01"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "host.os.type": [
      "linux"
    ],
    "log.source": [
      "fleet-server-default"
    ],
    "input.type": [
      "filestream"

[...]
and the Dashboard "[Elastic Agent] Concerning Agents" shows this message instead of the error message:

 "message": "Eat bulk checkin error; Keep on truckin'"

Is this a known bug? Can we do anything to fix it ourselves?

2

I wrote the same problem.

I think that problem is with upgrading alestic agent and It's stucks in progress. He can't upgrade and he's in frame task which a status is in upgrading (c.a 1 month).

3

This is unfortunatly a bug where we introduced a new metadata attribute local_metadata.elastic.agent.complete with the agent but did not add the mapping into elasticsearch, we're working on the fix that should go into our next patch releases: Add `complete` attribute to .fleet-agents docs by pkoutsovasilis · Pull Request #127651 · elastic/elasticsearch · GitHub

3 Likes