Illegal_argument_exception when metricbeat begins new index

Elastic Stack Beats
1

Hello! I had a metricbeat instance running 7.8.0, and when I first wired it up to logstash, then to elasticsearch, it generated an index, but whenever I tried to use it things like the Dashboards would not work, citing an illegal_argument_exception. Here is the full reason:

Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory

I was able to fix this before by deleting all the metricbeat indexes, and then running the setup wizard from within metricbeat (wired directly into elasticsearch, no logstash middleman). From then on (a few days at least) it was solved, no more errors. However, I just deployed metricbeat to a new system, and installed 7.8.1 instead of 7.8.0, and the warning is back. I don't want to have to run the wizard every time I setup a new version, is there some way to solve this permanently?

Thanks a ton!

2

Essentially, I believe I want a way to automate this process: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html through logstash, not directly to elasticsearch.

3

I ended up making a script that automatically checks and pulls the latest metricbeat instance and loads the template. Hope this helps someone else down the line!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.