No mapping found for [@timestamp]

[gur79 (tabu)]

i finally got it the main reason was that last time i updated my filebeat, i didn't bother to delete the old templates, and load there new ones.

and this thread below help me.

Filebeat v6 and elasticsearch v6

Hi, Just had the same issue, you need to update the template for filebeat & es6. You have the new mapping file in /etc/filebeat/filebeat.template-es6.json I deleted the previous one and load the new one but there may be a better option if you need to keep your data. curl -XDELETE http://localhost:9200/_template/filebeat curl -XPUT -H 'Content-Type: application/json' http://localhost:9200/_template/filebeat -d@filebeat.template-es6x.json See https://www.elastic.co/guide/en/beats/filebeat/cur…

Thanks a lot for your time.. you've been helpful