# Restoring "Stack Monitoring" after 6.8-\>7.2 upgrade
**URL:** https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241
**Category:** Kibana
**Tags:** elastic-stack-monitoring
**Created:** [July 7, 2019, 11:14am UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241 "2019-07-07T11:14:12Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 7, 2019, 11:14am UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/1 "2019-07-07T11:14:12Z")
So - this functionality _used_ to work. How do I get it back?
I've checked and Im collecting all the (seemingly) relevant system indexes: **.monitoring-[kibana|es|logstack]**.
When I click on this option in Kibana a panel opens on the right side with repeated text saying:
"Monitoring Request Error
[illegal\_argument\_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [event.dataset] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead. "
---
### Author:  [@joshdover](https://discuss.elastic.co/u/joshdover)
#### Post date: [July 8, 2019, 4:01pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/2 "2019-07-08T16:01:33Z")
@chrisronline Any ideas here? Should the fielddata setting be set on the mappings for monitoring indices? If so, why wouldn't it be set by default after an upgrade?
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 8, 2019, 4:18pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/3 "2019-07-08T16:18:02Z")
Hi @ethrbunny,
Could you post the outputs of `GET _template/.monitoring*` and `GET .monitoring-*/_mapping` please? Note that both will be rather large so you might want to post them in [https://pastebin.com](https://pastebin.com) and then post the link here.
Shaunak
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 9, 2019, 4:48am UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/4 "2019-07-09T04:48:00Z")
monitoring: [https://pastebin.com/sCYFE9pc](https://pastebin.com/sCYFE9pc)
mapping: [https://pastebin.com/Lu7FAgMr](https://pastebin.com/Lu7FAgMr)
Hopefully you can see both of those
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 9, 2019, 7:52am UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/5 "2019-07-09T07:52:37Z")
Thanks, both of those look good to me.
Next, could you please post the outputs of `GET _cat/indices/f*?v`, `GET _template/filebeat-*` and `GET filebeat-*/_mapping` please?
Thanks,
Shaunak
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 9, 2019, 1:37pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/6 "2019-07-09T13:37:38Z")
filebeat: [https://pastebin.com/0h11KNxe](https://pastebin.com/0h11KNxe)
filebeat-mapping: [https://pastebin.com/J8SCRQpL](https://pastebin.com/J8SCRQpL)
indices: [https://pastebin.com/pVZpWv0f](https://pastebin.com/pVZpWv0f)
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 9, 2019, 1:38pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/7 "2019-07-09T13:38:57Z")
NOTE: I get a similar error message (see top of thread) when I click on the new "SIEM" menu item and "View Hosts".
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 9, 2019, 11:47pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/8 "2019-07-09T23:47:25Z")
Looking at the mappings for the various `filebeat-*` indices, I see that the `event.dataset` field is mapped as `text`. This is the cause of your error. Now the question is why is this field mapped incorrectly.
The thing that looks most suspicious to me is that there appears to be no Filebeat index templates. This is almost certainly why the field is being mapped incorrectly. Just to double check that you have no Filebeat templates, could you post the response from `GET _cat/templates?v`, please?
Also, looking at your `filebeat-2019.07.*` indices, I notice an interesting pattern. All indices created with date \<= `2019.07.06` have 3 primary shards and 1 replica. The ones created with date \> `'2019.07.06` have 1 primary shard and 1 replica. Did something change on/around 2019.07.06? Is this when you upgraded from 6.8 -\> 7.2?
Finally, when you say you upgraded from 6.8 -\> 7.2, exactly what parts of the Elastic stack have you upgraded? Specifically, what version of Elasticsearch are you currently running? Same for Kibana? Same for Filebeat?
Thanks,
Shaunak
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 11, 2019, 6:00pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/9 "2019-07-11T18:00:44Z")
That's the upgrade date so it would make sense to have a transition there. I upgraded the entire stack: elastic, logstash, kibana, etc . Everything I could find.
Here is the \_cat/templates output:
```auto
name index_patterns order version
mysql [mysql*] 0
logstash [logstash-*] 0 60001
.ml-state [.ml-state*] 0 7020099
apache2 [logstash-*] 0 60001
.watch-history-9 [.watcher-history-9*] 2147483647
.monitoring-logstash [.monitoring-logstash-7-*] 0 7000199
.ml-meta [.ml-meta] 0 7020099
filebeat [filebeat*] 0
.monitoring-kibana [.monitoring-kibana-7-*] 0 7000199
.monitoring-alerts-7 [.monitoring-alerts-7] 0 7000199
kafka_consumer_lag [kafka_consumer_lag*] 0
metricbeat [metricbeat*] 0
.ml-config [.ml-config] 0 7020099
.kibana_task_manager [.kibana_task_manager] 0 7020099
.monitoring-es [.monitoring-es-7-*] 0 7000199
.data-frame-internal-1 [.data-frame-internal-1] 0 7020099
.logstash-management [.logstash] 0
.management-beats [.management-beats] 0 70000
.monitoring-beats [.monitoring-beats-7-*] 0 7000199
.watches [.watches*] 2147483647
.ml-notifications [.ml-notifications] 0 7020099
.ml-anomalies- [.ml-anomalies-*] 0 7020099
.triggered_watches [.triggered_watches*] 2147483647
.data-frame-notifications-1 [.data-frame-notifications-*] 0 7020099
```
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 11, 2019, 9:10pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/10 "2019-07-11T21:10:05Z")
Okay, I do see the Filebeat template. It's named `filebeat` (which is why my earlier request,`GET _template/filebeat-*`, didn't find it).
Could you please post the output of `GET _template/filebeat`?
Thanks,
Shaunak
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 11, 2019, 10:31pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/11 "2019-07-11T22:31:28Z")
{"filebeat":{"order":0,"index\_patterns":["filebeat\*"],"settings":{"index":{"codec":"best\_compression","mapping":{"total\_fields":{"limit":"2000"}}}},"mappings":{},"aliases":{}}}
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 11, 2019, 11:20pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/12 "2019-07-11T23:20:52Z")
Okay, that template definitely doesn't look right at all.
At this point I suggest the following steps:
- Stop all your Filebeat instances.
- Delete the bad template by running `DELETE _template/filebeat`
- Restart your Filebeat instances. This will create a new template.
- Please re-run `GET _template/filebeat*` and post the results here so we can check if the new template looks good.
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 14, 2019, 6:37pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/13 "2019-07-14T18:37:03Z")
I deleted the filebeat template but nothing is being created (except an empty "{ }").
What should "event.dataset" be mapped to?
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 14, 2019, 7:14pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/14 "2019-07-14T19:14:19Z")
I restored / recreated the default filebeat template as follows:
1. filebeat export template \> filebeat.template.json
2. curl --data "@filebeat.template.json" -XPUT "[http://elastic.ip:9200/\_template/filebeat\*](http://elastic.ip:9200/_template/filebeat*)" -H 'Content-Type: application/json'
When it rolls over tonight we'll see what changes.
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [July 15, 2019, 1:53pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/15 "2019-07-15T13:53:52Z")
No change in behavior or error msg this morning.
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 15, 2019, 8:37pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/16 "2019-07-15T20:37:17Z")
That's probably because old mappings are still present. The template change will only affect mappings created after the change.
Is it an option for you to delete the old Filebeat indices (the ones created before the template change)?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 12, 2019, 8:37pm UTC](https://discuss.elastic.co/t/restoring-stack-monitoring-after-6-8-7-2-upgrade/189241/17 "2019-08-12T20:37:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.