Metricbeat mapper error in 7.9.2

[frankfoti (Frank J. Foti ECE)]

I have a metricbeat pipeline that works fine sending data to my on premis cluster but getting this error sending to ES cloud:

"mapper [index_recovery.shards.index.size.reused_in_bytes] cannot be changed from type [long] to [float]"

I have all the 7.9.2 templates installed as well.

Any Ideas?

[frankfoti (Frank J. Foti ECE)]

I have also tried to remove the field but still getting the error:

filter {
  if [@metadata][pipeline] {
    mutate {
           id => "add-pipeline"
           add_field => { "metadata-pipeline" => "%{[@metadata][pipeline]}" }
    }
  }
  else {
    mutate {
           id => "no-pipeline"
           add_field => { "metadata-pipeline" => "None" }
    }
  }
  mutate {
    remove_field => ["[index_recovery][shards][index][size][reused_in_bytes]"]
  }
}

[2020-10-17T12:47:05,255][WARN ][logstash.outputs.elasticsearch][beats][elk-monitoring] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-7.9.2", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x51ee3c92>], :response=>{"index"=>{"_index"=>"metricbeat-7.9.2-2020.10.17-000001", "_type"=>"_doc", "_id"=>"u3d1N3UBfg4d2Zi4JEMC", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [index_recovery.shards.index.size.reused_in_bytes] cannot be changed from type [long] to [float]"}}}}

[frankfoti (Frank J. Foti ECE)]

I reduced this test case and it apears to be related to sending a second output from logstash. The second output to elasticsearch causes the error.

input {
  beats {
    id => "beats-01"
    port => 5046
  }
}

filter {
  if [@metadata][pipeline] {
    mutate {
           id => "add-pipeline"
           add_field => { "metadata-pipeline" => "%{[@metadata][pipeline]}" }
    }
  }
  else {
    mutate {
           id => "no-pipeline"
           add_field => { "metadata-pipeline" => "None" }
    }
  }
}


output {
if [@metadata][index] =~ /^.monitoring-*/ {
    # route stack monitoring data to monitoring Elasticsearch cluster
    if [@metadata][_id] {
      elasticsearch {
        id => "monitoring-index-id"
        index => "%{[@metadata][index]}-%{+YYYY.MM.dd}"
        document_id => "%{[@metadata][_id]}"
        hosts => ["https://192.168.9.100:9200"]
        user => elastic
        password => ******
        cacert => "/etc/logstash/ca.crt"
        ssl => true
      }
    } else {
      elasticsearch{
        id => "monitoring-index-noid"
        index => "%{[@metadata][index]}-%{+YYYY.MM.dd}"
        hosts => ["https://192.168.9.100:9200"]
        user => elastic
        password => ******
        cacert => "/etc/logstash/ca.crt"
        ssl => true
      }
    }
  } else
  if [@metadata][pipeline] {
  elasticsearch {
    id => "beats-pipeline"
    hosts => ["https://192.168.9.100:9200"]
    ilm_enabled => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    pipeline => "%{[@metadata][pipeline]}"
    user => elastic
    password => ******
    cacert => "/etc/logstash/ca.crt"
    ssl => true
  }
  }  else {
    if [@metadata][beat] == "winlogbeat" or [@metadata][beat] == "packetbeat"{
      elasticsearch {
        id => "iwinlogbeat-geoip-info"
        hosts => ["https://192.168.9.100:9200"]
        ilm_enabled => true
        manage_template => false
        index => "%{[@metadata][beat]}-%{[@metadata][version]}"
        pipeline => "geoip-info"
        user => elastic
        password => ******
        cacert => "/etc/logstash/ca.crt"
        ssl => true
      }
    }
    else {
      elasticsearch {
        id => "beats-nopipeline"
        hosts => ["https://192.168.9.100:9200"]
        ilm_enabled => true
        manage_template => false
        index => "%{[@metadata][beat]}-%{[@metadata][version]}"
        user => elastic
        password => ******
        cacert => "/etc/logstash/ca.crt"
        ssl => true
    }
   }
 }
}

output {
 elasticsearch {
        id => "beats-nopipeline2"
        hosts => ["https://192.168.9.100:9200"]
        ilm_enabled => true
        manage_template => false
        index => "%{[@metadata][beat]}-%{[@metadata][version]}-2"
        user => elastic
        password => ******
        cacert => "/etc/logstash/ca.crt"
        ssl => true
    }
}