We upgraded cluster from 7.12 to 7.15
new index created metricbeat-7.15.0 but now in index pattern it says I have mapping conflict
in older version there was a field type=conflict but no longer. how do I find which field are having conflict?
The writer's return status should tell you. That write will fail (even for bulk write).
Have you setup / loaded the new templates from metricbeat and upgraded all your beats to that same version?
You can also identify which beats agents are not running 7.15 by using Discover to filter Beats versions.
sudo metricbeat setup -e --strict.perms=false \
-E output.logstash.enabled=false \
-E output.elasticsearch.hosts=['x.x.x.x:9200'] \
-E output.elasticsearch.username=redacted \
-E output.elasticsearch.password=redacted \
-E setup.kibana.host=x.x.x.x:5601
No I have not updated all the agent.,
Agent will get updated slowly. only cluster got updated. I created new template metricbeat-7.15.0. all this is done via metricbeat config file.
due to many different agent it will get pushed out by puppet and eventually it should be all 7.15,
but in theory this should work without any problem as old index template and new index template is done via default fields.yml file
after upgrading ELK cluster to 7.15 , I checked everything was working fine.
then I change one system's metricbeat to 7.15 and created all required thing using following config
output.elasticsearch.index: "metricbeat-*"
setup.template.name: "metricbeat"
setup.template.pattern: "metricebat-*"
setup.template.fields: "/etc/metricbeat/fields.yml"
setup.ilm.overwrite: false
setup.ilm.enabled: auto
setup.ilm.policy_name: "metricbeat"
setup.ilm.rollover_alias: "metricbeat-%{[agent.version]}"
setup.ilm.pattern: "{now/d}-000001"
It did created new template metricbeat-7.15.0 and so on. new data also came in from new updated host. but only problem is that is complains it has mapping conflit. where is it?
Ok as test I remove all the records from metricbeat-7.15.0 as it has only one record from that one system.
index pattern still shows there is mapping conflict.
I found that on discover there is filter by type and has option called "conflict" even that displays nothing. even for huge time range that I selected.
alright fixed found it, putting it here incase someone is looking for this in feature.
on discover you select "filter by type= conflit" and then uncheck hide missing field
2 Likes
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.