Kibana is throwing error for Transaction Event field status

Elastic Stack Kibana
1

" Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [status] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field …"

I am pumping data from Packetbeat->Logstash->Elastic->Kibana

Do I need to modify the fields.yml in Packetbeat for this.

we learned that we need to need to modify the elastic with fieldadata as true , but this is not
solving our problem.

2

It sounds like maybe the index template wasn't loaded prior to the data being ingested, which lead to the wrong mapping types being inferred.

I would recommend first running the setup command from the CLI prior to ingesting data.

3

Thanks for quick response.

Yes , we missed this , we will correct this.

Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.