Shards failed in kibana

Elastic Stack Elasticsearch
1

Hello world,
Since I upgraded filebeat from 7.x to 8.x ( the version of my ELK and filebeat is 8.2.3 now), I can't see the dashboard anymore, I have encountered this problem on kibana:

1 of 8 shards failed
The data you are seeing might be incomplete or wrong.

and the information complet is:

Type illegal_argument_exception
Reason
Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [host.name] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

It seems like my index partterns can't refresh itself, I would like to ask if the only way to solve it is to manually add all the miss field?
(I hope not :slight_smile: )

Best regard

2

When you upgraded Filebeat did you re-run the setup command to upgrade the dashboards?

3

Thanks for the replay!
yes i've re setup with this configuration

filebeat.inputs:
- type: log
  id: my-filestream-id
  enabled: false 
    - /var/log/*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

setup.template.settings:
 index.number_of_shards: 1

setup.dashboards.enabled: true

setup.kibana:
   host: "http://a.d.d.r:5601"

output.elasticsearch:
   hosts: ["http://a.d.d.r:9200"]
  username: "username"
  password: "password"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Then i used filebeat setup -e and everything seems to be right :person_facepalming:

Best regard

4

Hello ( >﹏<。)
Someone can help pls?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.