Problem when activating Flattened field type on Filebeat fields.yml

Hello,

We encounter an error like the one in the following example ,when we activate Flattened field type on the template /etc/filebeat/fields.yml :

Filebeat version : 7.6.2
Elasticsearch version : 7.6.2

2021-04-15T00:19:19.917+0200    ERROR   pipeline/output.go:100  Failed to connect to backoff(elasticsearch(http://client_ip:9200)): Connection marked as failed because the onConnect callback failed: error loading template: error creating template from file /etc/filebeat/fields.yml: incorrect type configuration for field unexpected type 'flattened' for field 'xxx' accessing '7.fields.7' (source:'/etc/filebeat/fields.yml')
    2021-04-15T00:19:19.917+e0200    INFO    pipeline/output.go:93   Attempting to reconnect to backoff(elasticsearch(http://client_ip:9200)) with 5 reconnect attempt(s)

Below Cluster informations:

    curl -s  -H "Content-Type: application/json" -XGET "http://client_ip:9200"
    {
      "name" : "v-Logs01",
      "cluster_name" : "elastic",
      "cluster_uuid" : "Ql5ZjSVFQkyOrJjdkYv7kQ",
      "version" : {
        "number" : "7.6.2",
        "build_flavor" : "default",
        "build_type" : "rpm",
        "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
        "build_date" : "2020-03-26T06:34:37.794943Z",
        "build_snapshot" : false,
        "lucene_version" : "8.4.0",
        "minimum_wire_compatibility_version" : "6.8.0",
        "minimum_index_compatibility_version" : "6.0.0-beta1"
      },
      "tagline" : "You Know, for Search"
    }

Below Xpack endpoint output:

    curl -s  -H "Content-Type: application/json" -XGET "http://client_ip:9200/_xpack"
    {"build":{"hash":"ef48eb35cf30adf4db14086e8aabd07ef6fb113f","date":"2020-03-26T06:34:37.794943Z"},"license":{"uid":"0d8b1449-d9c2-46cf-900d-f25867fd2d47","type":"basic","mode":"basic","status":"active"},"features":{"analytics":{"available":true,"enabled":true},"ccr":{"available":false,"enabled":true},"enrich":{"available":true,"enabled":true},"flattened":{"available":true,"enabled":true},"frozen_indices":{"available":true,"enabled":true},"graph":{"available":false,"enabled":true},"ilm":{"available":true,"enabled":true},"logstash":{"available":false,"enabled":true},"ml":{"available":false,"enabled":true,"native_code_info":{"version":"7.6.2","build_hash":"e06ef9d86d5332"}},"monitoring":{"available":true,"enabled":true},"rollup":{"available":true,"enabled":true},"security":{"available":true,"enabled":false},"slm":{"available":true,"enabled":true},"spatial":{"available":true,"enabled":true},"sql":{"available":true,"enabled":true},"transform":{"available":true,"enabled":true},"vectors":{"available":true,"enabled":true},"voting_only":{"available":true,"enabled":true},"watcher":{"available":false,"enabled":true}},"tagline":"You know, for X"}[

Below License informations:

    curl -s  -H "Content-Type: application/json" -XGET "http://client_ip:9200/_license"
    {
      "license" : {
        "status" : "active",
        "uid" : "0d8b1449-d9c2-46cf-900d-f25867fd2d47",
        "type" : "basic",
        "issue_date" : "2018-09-28T15:51:11.932Z",
        "issue_date_in_millis" : 1538149871932,
        "max_nodes" : 1000,
        "issued_to" : "elastic",
        "issuer" : "elasticsearch",
        "start_date_in_millis" : -1
      }
    }

Thanks for your support.

Best Regards,
Salah-Eddine

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.