Kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

kibana: Invalid request payload JSON format Less Info OK Error: Bad Request at http://ip:port/bundles/commons.bundle.js:3:1605400

Getting above error while creating index pattern in Kibana.

Kibana version: 7.2.0
ES version: 7.2.0
Logstash version: 7.2.0
Filebeat version: 7.2.0

Can you share the index pattern you are creating? e.g. "my-index-*".

A screenshot may also help.

!

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"agent": {
"properties": {
"ephemeral_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"ecs": {
"properties": {
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"host": {
"properties": {
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"offset": {
"type": "long"
}
}
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}!

How about the es index mapping does it look good?

Note: Everything works fine when we replaced "filebeat + logstash" to fluentbit.
ES index mapping looks as below in case of fluentbit while mapping has a type (check above screenshot) keyword in case of logstash which might be creating problem.

{
"mapping": {
"properties": {
"@timestamp": {
"type": "date"
},
"hostname": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"log": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}

Is there anything you can help with? It also works fine with filebeat with elastic search output plugin.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.