Metricbeat is not loading fields.yml

Elastic Stack Beats
1

Hi,

I am using metricbeat 7.9.0 daemonset on k8s environment to export the metrics to ELK stack. But I am getting the errors like " Fielddata is disabled on text fields by default. Set fielddata=true on [cloud.account.id] in...."

And

GET /metricbeat-*/_mapping gave me below output:

        "cloud" : {
          "properties" : {
            "account" : {
              "properties" : {
                "id" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            },

All the fields are showing as 'text' fields instead of 'keyword' fields. I expected it to be like below:

        "cloud" : {
          "properties" : {
            "account" : {
              "properties" : {
                "id" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                },
                "name" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                }
              }
            },

I checked the fields.yml in the pod which is showing the fields as 'keyword' and 'ignore_above' as 1024. So looks like the fields.yml is not loaded as the metricbeat-* template.

I am new to ELK and it took me 2 days to figure out.

Can someone please help me in this regard on how to force the template mapping?

2

Hi!

You can always enable template loading by adding setup.template.overwrite: true in Filebeat's configuration: https://www.elastic.co/guide/en/beats/filebeat/7.8/filebeat-template.html

In this, the fields.yml will always be loaded on Filebeat's startup.

3

Thanks @ChrsMark

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.