# Metricbeat kubernetes module error in elasticsearch

**URL:** <https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 17, 2019, 8:46am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237 "2019-04-17T08:46:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ji\_Ho\_Choi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ji_ho_choi/32/42794_2.png) [@Ji\_Ho\_Choi](https://discuss.elastic.co/u/Ji_Ho_Choi)\
**Post date:** [April 17, 2019, 8:46am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237/1 "2019-04-17T08:46:40Z")

</div>

My beats is sending logs ok right now but elasticsearch is keep complaining about same error over and over. Pasted below.

I have metricbeat and filebeat applied as daemonset. What is elasticsearch complaining about?

the top error is like below

`{"type": "server", "timestamp": "2019-04-17T08:46:03,606+0000", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "docker-cluster", "node.name": "958d89c5861c", "cluster.uuid": "kZ1luwQbRSWtwuoLuEBHUA", "node.id": "tx2k9gjMQBGivx7K-J8u_Q", "message": "[metricbeat-7.0.0-2019.04.17][0] failed to execute bulk item (index) index {[metricbeat-7.0.0-2019.04.17][_doc][Jk95KmoBngZwgoV9c7xP], source[{\"@timestamp\":\"2019-04-17T08:46:02.553Z\",\"agent\":{\"version\":\"7.0.0\",\"type\":\"metricbeat\",\"ephemeral_id\":\"2f2686f4-4730-428a-aad6-03655d5e78a6\",\"hostname\":\"minikube\",\"id\":\"61a34126-ec90-4e41-8edc-8cd764acd9ee\"},\"service\":{\"type\":\"kubernetes\",\"address\":\"kube-state-metrics:8080\"},\"kubernetes\":{\"namespace\":\"kube-system\",\"labels\":{\"addonmanager\":{\"kubernetes\":{\"io/mode\":\"Reconcile\"}},\"app\":{\"kubernetes\":{\"io/name\":\"nginx-ingress-controller\",\"io/part-of\":\"kube-system\"}}},\"deployment\":{\"name\":\"nginx-ingress-controller\",\"replicas\":{\"desired\":1,\"available\":1,\"unavailable\":0,\"updated\":1},\"paused\":false}},\"event\":{\"dataset\":\"kubernetes.deployment\",\"module\":\"kubernetes\",\"duration\":105305060},\"metricset\":{\"name\":\"state_deployment\"},\"ecs\":{\"version\":\"1.0.0\"},\"host\":{\"name\":\"minikube\"}}]}" ,`

I paste in the rest as file because body has exceeded

 ![19%20PM](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8ca162493c2eb93b95b0642626b15f7d9628a061.png)

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 23, 2019, 10:55am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237/2 "2019-04-23T10:55:51Z")

</div>

It seems `kubernetes.labels.app` is already a keyword in your index but now you try to ingest an object into it. Which metricbeat version do you use? Did you deploy the metricbeat template? Can you share a bit more about your setup?

---

<div class="post-metadata">

**Author:** ![Ji\_Ho\_Choi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ji_ho_choi/32/42794_2.png) [@Ji\_Ho\_Choi](https://discuss.elastic.co/u/Ji_Ho_Choi)\
**Post date:** [April 23, 2019, 1:32pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237/3 "2019-04-23T13:32:12Z")

</div>

@ruflin hi, thanks for reply but ive ended up figuring things out myself. It was actually because beats 7.0.0 has ilm enabled by default so I had to setup the ilm index name

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2019, 1:41pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-error-in-elasticsearch/177237/4 "2019-05-21T13:41:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.