Kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

[Chandan_Kumar_Pathak]

kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

Getting above error while creating index pattern in Kibana.

Kibana version: 7.2.0
ES version: 7.2.0
Logstash version: 7.2.0
Filebeat version: 7.2.0

[nickpeihl]

Can you share the index pattern you are creating? e.g. "my-index-*".

A screenshot may also help.

[Chandan_Kumar_Pathak]

!

[Chandan_Kumar_Pathak]

[Chandan_Kumar_Pathak]

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"agent": {
"properties": {
"ephemeral_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"ecs": {
"properties": {
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"host": {
"properties": {
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"offset": {
"type": "long"
}
}
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}!

How about the es index mapping does it look good?

[Chandan_Kumar_Pathak]

Note: Everything works fine when we replaced "filebeat + logstash" to fluentbit.
ES index mapping looks as below in case of fluentbit while mapping has a type (check above screenshot) keyword in case of logstash which might be creating problem.

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"log": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}

[Chandan_Kumar_Pathak]

Is there anything you can help with? It also works fine with filebeat with elastic search output plugin.