Metricbeat breaks with Mapping Exception Error

[paul1243]

Hi-
I hit the below error, when I run the windows metricset:

Failed to connect to backoff(elasticsearch(http://172.20.23.100:9200)): Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template. Elasticsearch returned: couldn't load template: couldn't load json. Error: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"No handler for type [alias] declared on field [hostname]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_default_]: No handler for type [alias] declared on field [hostname]","caused_by":{"type":"mapper_parsing_exception","reason":"No handler for type [alias] declared on field [hostname]"}},"status":400}

Here is the yml config:

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#==================== Elasticsearch template setting ==========================
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
#================================ Outputs =====================================
output.elasticsearch:
  hosts: ["172.20.23.100:9200"]

Could someone please let me know what could be the issue. Thanks !

[pmercado (PM)]

Hi @paul1243 ,

can you check ElasticSearch version, and make sure the Alias field for the index is supported?
https://www.elastic.co/guide/en/elasticsearch/reference/current/alias.html

[paul1243]

Hi @pmercado
I use elasticsearch version 6.2, yes, it supports the Alias field.
I just tried adding the below line in the metribeats.yml and ran the beats again

index.mapping.single_type: true

but, this time its a different error:

WARN	elasticsearch/client.go:531	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf1cf9811a6b0020, ext:2196858201, loc:(*time.Location)(0x2b83b20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"agent":common.MapStr{"hostname":"win7prox68", "type":"metricbeat", "version":"7.0.0"}, "ecs":common.MapStr{"version":"1.0.0-beta2"}, "event":common.MapStr{"dataset":"windows.perfmon", "duration":5000300, "module":"windows"}, "host":common.MapStr{"name":"win7prox68"}, "metricset":common.MapStr{"name":"perfmon"}, "service":common.MapStr{"type":"windows"}, "windows":common.MapStr{"perfmon":common.MapStr{"process":common.MapStr{"handle":common.MapStr{"count":73}}, "process_handle_count":"csrss#2"}}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"illegal_argument_exception","reason":"Rejecting mapping update to [test_counters-2019.03.21] as the final mapping would have more than 1 type: [_doc, doc]"}

[paul1243]

@pmercado-
Any help on my issue ? Thanks !