Metricbeat illegal_argument_exception error

Elastic Stack Beats
1

Hi,

I'm trying to set up Metricbeat -> Elastic (8.9.0 on Ubuntu) using the HTTP JSON metricset, and had no problems at first, but then the output that is retrieved changed and now Metricbeat tells me "Cannot index event" because

{"type":"illegal_argument_exception","reason":"mapper [http.json_namespace.storageservice.storageshares.totalsize] cannot be changed from type [long] to [float]"}, dropping event!

Storageshares here is an array. In the first element of the array, totalsize is 0, but in subsequent elements it's a long, so it seems that elastic is assigning it to be a float based on the first element and then throwing this error when it gets to the next ones. I tried to explicitly tell it that this field is a long in my metricbeat.yml file like this:

setup.template.overwrite: true
setup.template.append_fields:
- name: http.json_namespace.storageservice.storageshares.totalsize
  type: long

However, although I can see that the field is added to the index template using the API
GET _index_template/metricbeat-8.9.0
I still see the same error. My guess is that this is because storageshares is an array, in which case how can I work around this problem? Alternatively, since I'm fairly new to elastic, it's possible that I've made a silly mistake somewhere. Any suggestions would be greatly appreciated.

thanks,

will

2

Just to follow up, I ended up using logstash instead of metricbeat, which worked without problems.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.