Invalid_index_template_exception

Elastic Stack Beats
1

Hi,

image
image787×125 14.6 KB

Today I've added a new integration "Custom Windows Event Logs" but with a custom Dataset name. Sadly I've made a mistake and put some capitalisation in it (winlog.TerminalServices) and the integration didn't go well.

I've recreated it from scratch with a new dataset name (winlog.tse) and this time it goes well.
But now when trying to create the same integration in another agent policy, despite selecting the good dataset (winlog.tse) I get an error related to the previously mistakenly created dataset.

image
image758×323 25.7 KB

image

Error installing winlog 2.1.0: invalid_index_template_exception Root causes: invalid_index_template_exception: index_template [logs-winlog.TerminalServices@package] invalid, cause [Validation Failed: 1: name must be lower cased;]

From the name "winlog.TerminalServices@package" it seems to be a component template but I can't find it (from Stack Management or the Dev Tools Console). It is expected as it was not created because of the wrong name.

And even when I try to update the integration, I encounter the same error. That's weird!

image
image898×526 38.3 KB

image
image763×242 14.7 KB

I did a full rolling restart of my cluster but it's not better.

Bonus question please :
Why is there so many dataset with the same name appearing in this list?

image
image788×463 28.4 KB

Thanks a lot for your help!
Regards.

2

Hi all,
Just a little push in order to know if it's a bug from Elastic or a misconfiguration on my side please.
Currently I'm pretty stuck as this integration is already deployed on many Agent Policies...
Thanks a lot for your help!
Regards.

3

Hi all,

As I was unable to do anything with this integration (update, reinstall, uninstall), here is a quick workaround below.

Steps I've done :

  • Delete all "Custom Windows Event Logs" integrations in each Agent Policies
  • Uninstall it from Kibana > Integrations > Installed Integrations > Settings
  • Reinstall it from the same panel
  • From the same panel, add it again for each Agent Policies

TLDR; uninstall then reinstall from scratch.
Have a great day!