Kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

#1

kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

Getting above error while creating index pattern in Kibana.

Kibana version: 7.2.0
ES version: 7.2.0
Logstash version: 7.2.0
Filebeat version: 7.2.0

#2

Can you share the index pattern you are creating? e.g. "my-index-*".

A screenshot may also help.

#3

50%20PM
Screenshot 2019-07-30 at 1.03.50 PM.png2458×1134 282 KB
!

#4

24%20PM
Screenshot 2019-07-30 at 1.04.24 PM.png2444×1072 214 KB

#5

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"agent": {
"properties": {
"ephemeral_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"ecs": {
"properties": {
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"host": {
"properties": {
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"offset": {
"type": "long"
}
}
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}!

46%20PM
Screenshot 2019-07-30 at 1.32.46 PM.png1946×1118 310 KB

How about the es index mapping does it look good?

#6

Note: Everything works fine when we replaced "filebeat + logstash" to fluentbit.
ES index mapping looks as below in case of fluentbit while mapping has a type (check above screenshot) keyword in case of logstash which might be creating problem.

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"log": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}

#7

Is there anything you can help with? It also works fine with filebeat with elastic search output plugin.