I'm real sorry if I'm asking newbie question, i have been introduced to ELK sack last 2 weeks
here's my story, i have this internal network of 10 different servers and I'm collecting logs from all of them (using filebeat system module).
i have this one server which is running logstash to collect all logs and elasticsearch plus kibana
i decide to use X-pack for logging users in and having different users
here's how i'm debuggig it.
on logstash, the pipeline i'm using is the default one taken from official website for parsing filebeat system module
then when i run logstash with
bin/logstash -f pipeline.conf --path.settings /etc/logstash/
i'm getting that [logstash.filters.elasticsearch] Failed to query elasticsearch for previous event.
here's the whole message:
[2018-07-25T14:14:45,948][WARN ][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=>"", :query=>"", :event=>#LogStash::Event:0x4bbccba9, :error=>#<RuntimeError: Elasticsearch query error: [{"shard"=>0, "index"=>".kibana", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"5olmNGoaQJyvs6LP8L9ZUA", "index"=>".kibana"}}, {"shard"=>0, "index"=>".ml-anomalies-shared", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"as9JnEjTTpqH5xCgOz8xTQ", "index"=>".ml-anomalies-shared"}}, {"shard"=>0, "index"=>".ml-notifications", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"nE6_0GetS9aV3xEScT9DUg", "index"=>".ml-notifications"}}, {"shard"=>0, "index"=>".monitoring-alerts-6", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"KseNNb_sTYSPn977ec_5iA", "index"=>".monitoring-alerts-6"}}, {"shard"=>0, "index"=>".monitoring-es-6-2018.07.25", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"CGDU9lywShq01Eo3irsE0g", "index"=>".monitoring-es-6-2018.07.25"}}, {"shard"=>0, "index"=>".monitoring-kibana-6-2018.07.25", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"_pAhA2y7T-OpmoOOAzSJ0Q", "index"=>".monitoring-kibana-6-2018.07.25"}}, {"shard"=>0, "index"=>".security-6", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"3hysFJAUT_KAcZrXnsx4dw", "index"=>".security-6"}}, {"shard"=>0, "index"=>".triggered_watches", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"Fiy_fakLSmasnMWpcxsiKA", "index"=>".triggered_watches"}}, {"shard"=>0, "index"=>".watcher-history-7-2018.07.25", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"Xgac_ryLRS2c1obJ8Wm9dg", "index"=>".watcher-history-7-2018.07.25"}}, {"shard"=>0, "index"=>".watches", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"gD3IB1S-TfOWqUFw8r27KA", "index"=>".watches"}}, {"shard"=>0, "index"=>"filebeat-2018.07.24", "node"=>"yw1ItHevQDON-5vGOsQj9Q", "reason"=>{"type"=>"query_shard_exception", "reason"=>"No mapping found for [@timestamp] in order to sort on", "index_uuid"=>"DQqCKrU7TYW9JuckfZZntw", "index"=>"filebeat-2018.07.24"}}]>}
is there any way of correcting this "No Mapping found for @timestamp" on my indices (i have filebeat-*,) and these system indices (.monitor, .watchers, .ml-anomalies, etc..)
or am i doing it the wrong way??