Hi,
I'm trying to set up Metricbeat -> Elastic (8.9.0 on Ubuntu) using the HTTP JSON metricset, and had no problems at first, but then the output that is retrieved changed and now Metricbeat tells me "Cannot index event" because
{"type":"illegal_argument_exception","reason":"mapper [http.json_namespace.storageservice.storageshares.totalsize] cannot be changed from type [long] to [float]"}, dropping event!
Storageshares here is an array. In the first element of the array, totalsize is 0, but in subsequent elements it's a long, so it seems that elastic is assigning it to be a float based on the first element and then throwing this error when it gets to the next ones. I tried to explicitly tell it that this field is a long in my metricbeat.yml file like this:
setup.template.overwrite: true
setup.template.append_fields:
- name: http.json_namespace.storageservice.storageshares.totalsize
type: long
However, although I can see that the field is added to the index template using the API
GET _index_template/metricbeat-8.9.0
I still see the same error. My guess is that this is because storageshares is an array, in which case how can I work around this problem? Alternatively, since I'm fairly new to elastic, it's possible that I've made a silly mistake somewhere. Any suggestions would be greatly appreciated.
thanks,
will