Indices Stack Monitoring - Cannot expand `inner_hits` for collapse field `index_stats.index`

Elastic Stack Elastic Agent
,
1

Hello,
We have updated to Elasticsearch 9.4.0, Kibana 9.4.0, Elastic Agent 9.4.0 and Elasticsearch monitoring integration 1.20.2.
Since then, the Stack Monitong Indices tab is broken and does not load the dashboard:

image
image690×442 37.1 KB

The error message is:

[search_phase_execution_exception Caused by: illegal_argument_exception: cannot expand inner_hits for collapse field index_stats.index, only indexed field can retrieve inner_hits Root causes: illegal_argument_exception: cannot expand inner_hits for collapse field index_stats.index, only indexed field can retrieve inner_hits: search_phase_execution_exception Caused by: illegal_argument_exception: cannot expand inner_hits for collapse field index_stats.index, only indexed field can retrieve inner_hits Root causes: illegal_argument_exception: cannot expand inner_hits for collapse field index_stats.index, only indexed field can retrieve inner_hits]: all shards failed

My research suggests that this error may be because field index_stats.index is an alias to field elasticsearch.index.name in data_stream metrics-elasticsearch.stack_monitoring.index-default.

image
image643×256 11.7 KB

Kibana uses collapse+inner_hits and Elasticsearch doesn't support this for an alias field. Is this correct?

2

Does nobody else have this error?

3

I solved the issue after asked an IA tool.

  1. Create a component template for metrics-elasticsearch.stack_monitoring.index
PUT _component_template/metrics-elasticsearch.stack_monitoring.index@custom
{
  "template": {
    "mappings": {
      "properties": {
        "elasticsearch": {
          "properties": {
            "index": {
              "properties": {
                "name": {
                  "type": "keyword",
                  "index": true,
                  "time_series_dimension": true
                }
              }
            }
          }
        }
      }
    }
  }
}

  1. Delete data_stream metrics-elasticsearch.stack_monitoring.index-default

  2. A new data_stream and a backing index is generated automatically with correct mapping "index": true for the field elasticsearch.index.name

  3. Now, the indices tab of Stack Monitoring is working fine.