No cached mapping for this field.Refresh field list from the lanagement

Elastic Observability APM
1

image
image1736×1058 111 KB

I tried "Management -> Index Patterns and hit Refresh button",but it didn't work.

I updated the fields.yml http field of apmserver, but it is still useless.

apmserver: 7.6.2
ELK: 7.4.2

image
image1320×817 25.6 KB

2

Hi @wajika,
instead of directly changing the fields.yml you can add additional fields to your mapping via configuring setup.template.append_fields in the apm-server.yml. If you want to enable dynamic for http.request.headers you could configure:

setup.template.append_fields:
- name: http.request.headers
  type: group
  dynamic: true

Be aware though that a template only gets applied to newly created indices. If the index existed before you changed the template, the changes won't be applied to this index. You can check if the template mapping has been applied by calling GET apm-*transaction/_mapping.

3

After I use setup.template.append_fields, the transaction index no longer appears.
I deleted all apm indexes and then restarted apmserver.

image
image1488×697 56 KB

image
image1684×303 10.1 KB

apmserver log
https://paste.ubuntu.com/p/jbYPcgXCzp/

es log
https://paste.ubuntu.com/p/cMfNjMCxJx/

4

setup.template.append_fields:

  • name: http.request.headers >>> If I write http.request.headers can it affect the http.request.body.original field (depth four levels)
    type: group
    dynamic: true
5 
ERROR	pipeline/output.go:100	Failed to connect to backoff(elasticsearch(xxx)): Connection marked as failed because the onConnect callback failed: resource 'apm-7.6.2-span' exists, but it is not an alias

This error from your apm-server.log file suggests that the apm-7.6.2-span exists as index, while it should be a write alias. You can find more information about when this error happens in Issues#3698.

If I write http.request.headers can it affect the http.request.body.original field (depth four levels)

You can specify an array of fields to append to the template. Every field definition will only be applied to the specified group of fields. Therefore http.request.headers will not impact http.request.body.original, but only everything nested under http.request.headers.
In case you would like to index the body, you could for example specify it as multifield:

setup.template.append_fields:
  - name: http.request.headers
    type: group
    dynamic: true
  - name: http.request.body.original
    type: keyword
    ignore_above: 1024
    multi_fields:
      - name: text
        type: text
6

Thank you for the method @simitt

7

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.