Metricbeat kubernetes module error in elasticsearch

My beats is sending logs ok right now but elasticsearch is keep complaining about same error over and over. Pasted below.

I have metricbeat and filebeat applied as daemonset. What is elasticsearch complaining about?

the top error is like below

{"type": "server", "timestamp": "2019-04-17T08:46:03,606+0000", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "docker-cluster", "node.name": "958d89c5861c", "cluster.uuid": "kZ1luwQbRSWtwuoLuEBHUA", "node.id": "tx2k9gjMQBGivx7K-J8u_Q", "message": "[metricbeat-7.0.0-2019.04.17][0] failed to execute bulk item (index) index {[metricbeat-7.0.0-2019.04.17][_doc][Jk95KmoBngZwgoV9c7xP], source[{\"@timestamp\":\"2019-04-17T08:46:02.553Z\",\"agent\":{\"version\":\"7.0.0\",\"type\":\"metricbeat\",\"ephemeral_id\":\"2f2686f4-4730-428a-aad6-03655d5e78a6\",\"hostname\":\"minikube\",\"id\":\"61a34126-ec90-4e41-8edc-8cd764acd9ee\"},\"service\":{\"type\":\"kubernetes\",\"address\":\"kube-state-metrics:8080\"},\"kubernetes\":{\"namespace\":\"kube-system\",\"labels\":{\"addonmanager\":{\"kubernetes\":{\"io/mode\":\"Reconcile\"}},\"app\":{\"kubernetes\":{\"io/name\":\"nginx-ingress-controller\",\"io/part-of\":\"kube-system\"}}},\"deployment\":{\"name\":\"nginx-ingress-controller\",\"replicas\":{\"desired\":1,\"available\":1,\"unavailable\":0,\"updated\":1},\"paused\":false}},\"event\":{\"dataset\":\"kubernetes.deployment\",\"module\":\"kubernetes\",\"duration\":105305060},\"metricset\":{\"name\":\"state_deployment\"},\"ecs\":{\"version\":\"1.0.0\"},\"host\":{\"name\":\"minikube\"}}]}" ,

I paste in the rest as file because body has exceeded

It seems kubernetes.labels.app is already a keyword in your index but now you try to ingest an object into it. Which metricbeat version do you use? Did you deploy the metricbeat template? Can you share a bit more about your setup?

@ruflin hi, thanks for reply but ive ended up figuring things out myself. It was actually because beats 7.0.0 has ilm enabled by default so I had to setup the ilm index name

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.