If cloud/availability_zone in metric logs is set to number metadata view in kibana is failing

[molsza (Michal Olsza)]

In metricbeat settings I am setting cloud/availability_zone to numbers. It is working in main views of metrics in kibana except this one:

https://localhost/kibana/app/metrics/detail/host/<host-name>

You can navigate to it from APM overview page or opening Metadata tab in Metrics/Inventory

Error:

Uncaught (in promise) Error: Failed to validate: 
  in info/cloud/availability_zone: 1 does not match expected type string
    createPlainError https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.plugin.js:2
    throwErrors https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.plugin.js:2
    fold https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.plugin.js:2
    pipe https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.plugin.js:2
    <anonymous> https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.8.js:92
    onResolve https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.4.js:3
    promise https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.0.js:3
    promise callback*useTrackedPromise/execute</< https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.0.js:3
    useMetadata https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.8.js:92
    useMetadata https://localhost/kibana/44040/bundles/plugin/infra/8.0.0/infra.chunk.8.js:92
    wa https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    Wl https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    unstable_runWithPriority https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:398
    Kr https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    jl https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    Cl https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    Qr https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    unstable_runWithPriority https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:398
    Kr https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    Qr https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    Jr https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    wl https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    vc https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390
    render https://localhost/kibana/44040/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:390

ELK v7.15

[weltenwort (Felix Stürmer)]

Hi @molsza,

that is curious My initial guess would be that the mappings for the metrics indices are not applied correctly. ECS defines the cloud.availability_zone field as a keyword while the error message suggests it's a number in your case.

Can you check the mappings of the metrics indices and specifically of the cloud.availability_zone field?

[molsza (Michal Olsza)]

Hi, mapping looks fine. It is a keyword. After I've changed the metricbeat config to send something which is not a pure number like 'F1', it was successfully indexed (shouldn't happen if the index type was wrong). After that UI also started working.

[weltenwort (Felix Stürmer)]

But that indicates that the index template was not installed correctly. What you're describing is that Elasticsearch used its dynamic mapping capabilities to guess the field type from the first value it sees. If the index template is installed correctly it should force the field's type to be a keyword regardless of the submitted value.

So I'd recommend to check that the index templates were installed correctly using metricbeat setup. With the proper index template you might run into other parts of Kibana not working correctly as well.

[molsza (Michal Olsza)]

Mapping has not changed, it was the mapping created by metricbeat itself. It was a keyword before as well as it is now. I could have working and not working hosts (metricbeat's instances) at the same time - depending what they have in the configuration.