I've just added Logstash to my ELK stack setup. I've got filebeat working, but metricbeat is causing trouble.
When I navigate to the Infrastructure screen, I get an error in elasticsearch:
"Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.", "at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:767) ~[elasticsearch-7.1.0.jar:7.1.0]", "at org.elasticsearch.index.fielddata.IndexFieldDataService.getForField(IndexFieldDataService.java:116) ~[elasticsearch-7.1.0.jar:7.1.0]", ...
I've seen this before as a (maybe) red herring error, but I'm not sure what's causing it this time. I have my logstash output going to both elasticsearch and stdout, and I'm seeing a steady flow of data to logstash.
I now see in the Elasticsearch Logs a lot of
"failed to find message" messages that are sourced from metricbeat on the logstash index. What could be causing this?