Heartbeat 8.5.0 mapper error workaround

[Andrew_Cholakian1 (Andrew Cholakian)]

Hi all, Andrew from Elastic here, Tech Lead for Heartbeat. We're sorry to report that Heartbeat 8.5.0 has a severe bug that will break indexing in most installs after ~30m of runtime. The good news is there's an easy workaround that will fix it, detailed below. If you'd rather wait until Elastic Stack 8.5.1 is released that will also work. Read on for details.

The error in question will look like the following in the Heartbeat logs:

{..., "reason":"failed to parse date field [4.0614878e+07] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"date_time_parse_exception: Failed to parse with all enclosed parsers"}

To fix it perform the following steps to use the correct mapping settings:

1. Locate heartbeat-8.5.0 index template under Index Templates from Stack Management > Index Management

2. Hover over the row and click the 'edit' pencil icon

3. The Edit UI will load

4. Click on the "mappings" circle (step 4), and locate duration_ms under state. Click the 'edit' pencil icon again.

5. Change the Field Type to "Numeric" then the "Numeric Type" to "long" and click "Update.

9. Click on the "Review" circle (step 9) and click "Save Template"

10. Now, we just need to rotate the index for the changes to take effect. Go to "dev tools using the left hand navigation"

11. Enter the following API request and click the run arrow to execute it:

Heartbeat 8.5.0 should now function correctly!