Hello,
We encounter an error like the one in the following example ,when we activate Flattened field type on the template /etc/filebeat/fields.yml :
Filebeat version : 7.6.2
Elasticsearch version : 7.6.2
2021-04-15T00:19:19.917+0200 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://client_ip:9200)): Connection marked as failed because the onConnect callback failed: error loading template: error creating template from file /etc/filebeat/fields.yml: incorrect type configuration for field unexpected type 'flattened' for field 'xxx' accessing '7.fields.7' (source:'/etc/filebeat/fields.yml')
2021-04-15T00:19:19.917+e0200 INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch(http://client_ip:9200)) with 5 reconnect attempt(s)
Below Cluster informations:
curl -s -H "Content-Type: application/json" -XGET "http://client_ip:9200"
{
"name" : "v-Logs01",
"cluster_name" : "elastic",
"cluster_uuid" : "Ql5ZjSVFQkyOrJjdkYv7kQ",
"version" : {
"number" : "7.6.2",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
"build_date" : "2020-03-26T06:34:37.794943Z",
"build_snapshot" : false,
"lucene_version" : "8.4.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
Below Xpack endpoint output:
curl -s -H "Content-Type: application/json" -XGET "http://client_ip:9200/_xpack"
{"build":{"hash":"ef48eb35cf30adf4db14086e8aabd07ef6fb113f","date":"2020-03-26T06:34:37.794943Z"},"license":{"uid":"0d8b1449-d9c2-46cf-900d-f25867fd2d47","type":"basic","mode":"basic","status":"active"},"features":{"analytics":{"available":true,"enabled":true},"ccr":{"available":false,"enabled":true},"enrich":{"available":true,"enabled":true},"flattened":{"available":true,"enabled":true},"frozen_indices":{"available":true,"enabled":true},"graph":{"available":false,"enabled":true},"ilm":{"available":true,"enabled":true},"logstash":{"available":false,"enabled":true},"ml":{"available":false,"enabled":true,"native_code_info":{"version":"7.6.2","build_hash":"e06ef9d86d5332"}},"monitoring":{"available":true,"enabled":true},"rollup":{"available":true,"enabled":true},"security":{"available":true,"enabled":false},"slm":{"available":true,"enabled":true},"spatial":{"available":true,"enabled":true},"sql":{"available":true,"enabled":true},"transform":{"available":true,"enabled":true},"vectors":{"available":true,"enabled":true},"voting_only":{"available":true,"enabled":true},"watcher":{"available":false,"enabled":true}},"tagline":"You know, for X"}[
Below License informations:
curl -s -H "Content-Type: application/json" -XGET "http://client_ip:9200/_license"
{
"license" : {
"status" : "active",
"uid" : "0d8b1449-d9c2-46cf-900d-f25867fd2d47",
"type" : "basic",
"issue_date" : "2018-09-28T15:51:11.932Z",
"issue_date_in_millis" : 1538149871932,
"max_nodes" : 1000,
"issued_to" : "elastic",
"issuer" : "elasticsearch",
"start_date_in_millis" : -1
}
}
Thanks for your support.
Best Regards,
Salah-Eddine