we have ELK 7.5.1 setup and different clusters that we want to report into different Kibana spaces that we created for such purpose. We have configured various beats to report into their respective indexes and this works fine - we see in Discover that data including metrics goes into those indexes. We've set up each space to track their respective indexes.
What we're struggling with is display of this data in Metrics specifically. Strangely it works fine with Filebeats shipping logs. But in Metrics we're getting errors like:
Error: GraphQL error: [illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [event.dataset] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword
We can solve this for existing indexes by applying
"fielddata": true on specific fields, but this obviously won't help with newly created indexes (we have daily).
Here are the relevant lines from our
metricbeats.yml, this one is for metrics from ELK cluster itself to be reported into
output.logstash: hosts: ["elasticsearch:logstash_port"] ssl.certificate_authorities: [ "/ca.cert" ] index: "metricbeat-elk" setup: kibana: host: "elasticsearch:kibana_port" protocol: "https" ssl.certificate_authorities: [ "/ca.cert" ] path: / username: elastic password: elasticpasswd space.id: "elk" template: enabled: true name: "metricbeat-elk" pattern: "metricbeat-elk-*" overwrite: true dashboards: enabled: true index: "metricbeat-elk-*"
are we doing something wrong or is this a bug in Metricbeat 7.5.1?