Mapper_parsing_exception in filebeat logs suddenly

Elastic Stack Beats
1

Suddenly from midnight yesterday, stopped seeing logs in Kibana, and Filebeat logs has the following. Didnot do any change. Please help

2018-03-16T14:43:56+05:30 WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}
2018-03-16T14:43:56+05:30 WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}

2

Which filebeat version(s) are you running? This looks like a mapping conflict on the error field. This can be the case if filebeat 6.x is being run with a 5.x template mapping in Elasticsearch.

Check if you have multiple mapping templates, which will match filebeat. The mapping is versioned in newer filebeat versions. But old templates still match on filebeat-*.

3

Yes, I think I tried installing Filebeat 5x in one of the servers and that lead to this template mismatch. This actually blocked logs push from other servers too, where Filebeat 6x was originally installed..

Having said that, whats the solution here Steffens

Thanks

4

Not sure which beats version we introduced versioning. At least filebeat version 5.6 should already version the template mapping and index names.

First of all, find the name of the wrong template mapping. Then delete the template mapping installed by filebeat 5.x. As todays index has been generated with a wrong mapping, you have to delete the affected index as well, so a new index with the correct mapping can be created.

If you plan to run filebeat 5.x next to 6.x, only use 5.6. Also check configs actually using the version in the template mapping using versions. Otherwise you might run into the issue again.

5

Thanks Steffens
However my Kibana console always throws an error "Failed to connect to Console's backend.
Please check the Kibana server is up and running", preventing me from doing the recommended amendments. Could you please suggest an alternative or a way to fix the kibana console error

6

Alternatively you can do the fix over curl.

For your console kibana issue: Does Kibana all work besides that issue?

7

Yes. Kibana all works beside that issue

8

I don't think this issue is Beats related. Could you post it into the Kibana forum: https://discuss.elastic.co/c/kibana Best check your kibana logs if you see some Error messages there. Restarting could also help.

9

But Ruflin, If you'd seen my initial comment, it seems to be a version conflict, which is related to Filebeat

10

Hello Ruflin, Please help. Tried every possible thing to solve this.

11

Yes, the conflict you posted in your first post is related to a version conflict in Filebeat. But the one you posted that you can't open Console I can't see how it could be related. I'm redirecting you to the Kibana only for the COnsole issue, not the one in your first post.

As recommended earlier, if you can't use Console to put in your commands, best use curl from the command line to remove the templates.

12

Thanks Ruflin, It worked. Now I am able to see data. But unfortunately, the older data just disappeared. Is there a way to retrieve the older data as well. Thanks in advance

13

Great to hear we are moving forward. Which commands did you exactly run? Did you delete the indices? If yes the old data is done. If no, you should still see the old data if change the time frame in kibana.

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.