Metricbeat won't work with spaces

Hello,

we have ELK 7.5.1 setup and different clusters that we want to report into different Kibana spaces that we created for such purpose. We have configured various beats to report into their respective indexes and this works fine - we see in Discover that data including metrics goes into those indexes. We've set up each space to track their respective indexes.

What we're struggling with is display of this data in Metrics specifically. Strangely it works fine with Filebeats shipping logs. But in Metrics we're getting errors like:
Error: GraphQL error: [illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [event.dataset] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword
We can solve this for existing indexes by applying "fielddata": true on specific fields, but this obviously won't help with newly created indexes (we have daily).

Here are the relevant lines from our metricbeats.yml, this one is for metrics from ELK cluster itself to be reported into elk space:

output.logstash:
  hosts: ["elasticsearch:logstash_port"]
  ssl.certificate_authorities: [ "/ca.cert" ]
  index: "metricbeat-elk"

setup:
  kibana:
    host: "elasticsearch:kibana_port"
    protocol: "https"
    ssl.certificate_authorities: [ "/ca.cert" ]
    path: /
    username: elastic
    password: elasticpasswd
    space.id: "elk"
  template:
    enabled: true
    name: "metricbeat-elk"
    pattern: "metricbeat-elk-*"
    overwrite: true
  dashboards:
    enabled: true
    index: "metricbeat-elk-*"

are we doing something wrong or is this a bug in Metricbeat 7.5.1?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.