Metricbeat cannot create index

Elastic Stack Beats
1

Hello I am trying to add metricbeat to the elasticsearch but it does not seam to be able to create the index. I've tried loading the data manually and I get the following error message.

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "unknown key [cloud] for create index"
      }
    ],
    "type": "parse_exception",
    "reason": "unknown key [cloud] for create index"
  },
  "status": 400
}

the data I was loading is:

{
   "@timestamp": "2019-07-11T19:08:26.079Z",
   "@metadata": {
     "beat": "metricbeat",
     "type": "_doc",
     "version": "7.2.0"
   },
   "metricset": {
     "name": "diskio"
   },
   "service": {
     "type": "system"
   },
   "agent": {
     "hostname": "prod-nv-front-01",
     "id": "520a2a98-5aaf-4d94-87ec-15bb50e56e1c",
     "version": "7.2.0",
     "type": "metricbeat",
     "ephemeral_id": "514e89e3-498b-4c52-8668-28940317bd51"
   },
   "host": {
     "name": "prod-nv-front-01",
     "hostname": "prod-nv-front-01",
     "architecture": "x86_64",
     "os": {
       "name": "Ubuntu",
       "kernel": "4.15.0-1040-aws",
       "codename": "bionic",
       "platform": "ubuntu",
       "version": "18.04.2 LTS (Bionic Beaver)",
       "family": "debian"
     },
     "id": "ec2005a33d129c9c9e2003ddb2ae6cca",
     "containerized": false
   },
   "cloud": {
     "machine": {
       "type": "r5.large"
     },
     "region": "us-east-1",
      "availability_zone": "us-east-1a",
 "instance": {
   "id": "i-02004fe4346d00cd3"
 },
 "provider": "aws"
   },
   "system": {
     "diskio": {
       "name": "loop2",
       "read": {
         "time": 41524,
         "bytes": 95440896,
         "count": 92909
       },
       "write": {
         "count": 0,
         "time": 0,
         "bytes": 0
       },
       "io": {
         "time": 1496
       },
       "iostat": {
         "queue": {
           "avg_size": 0
         },
         "request": {
           "avg_size": 0
         },
         "await": 0,
         "service_time": 0,
         "busy": 0,
         "read": {
           "request": {
             "merges_per_sec": 0,
             "per_sec": 0
           },
           "per_sec": {
             "bytes": 0
           },
           "await": 0
         },
         "write": {
           "await": 0,
           "request": {
             "merges_per_sec": 0,
             "per_sec": 0
           },
           "per_sec": {
             "bytes": 0
           }
         }
       }
     }
   },
   "event": {
     "module": "system",
     "duration": 792680,
     "dataset": "system.diskio"
   },
   "tags": [
     "jetty"
   ],
   "fields": {
     "@environment": "prod-new"
   },
   "ecs": {
     "version": "1.0.0"
   }
 }
2

even tried with:

curl -XPUT "http://localhost:9200/metricbeat-7.2.0-2019.07.11" -H 'Content-Type: application/json' -d'{  "test" : "value"}'

and got the following answer:

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "unknown key [test] for create index"
      }
    ],
    "type": "parse_exception",
    "reason": "unknown key [test] for create index"
  },
  "status": 400
}
3

Hello! What version of Elasticsearch and Metricbeat are you running? Seems like the index template is not fully loaded into ES. But Metricbeat should be loading the template automatically. For metricbeat.yml, are you using the default?

4

7.2.0 on both ends. I've figure it out. There were multiple templates loaded for metricbeat from the time it was running on elasticsearch 6.6.1. Once I've deleted the old templates data started to come in. Thank you for your help anyways.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.