Shards failed in kibana

Hello world,
Since I upgraded filebeat from 7.x to 8.x ( the version of my ELK and filebeat is 8.2.3 now), I can't see the dashboard anymore, I have encountered this problem on kibana:

1 of 8 shards failed
The data you are seeing might be incomplete or wrong.

and the information complet is:

Type illegal_argument_exception
Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [] in order to load field data by uninverting the inverted index. Note that this can use significant memory.

It seems like my index partterns can't refresh itself, I would like to ask if the only way to solve it is to manually add all the miss field?
(I hope not :slight_smile: )

Best regard

When you upgraded Filebeat did you re-run the setup command to upgrade the dashboards?

Thanks for the replay!
yes i've re setup with this configuration

- type: log
  id: my-filestream-id
  enabled: false 
    - /var/log/*.log

  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

 index.number_of_shards: 1

setup.dashboards.enabled: true

   host: "http://a.d.d.r:5601"

   hosts: ["http://a.d.d.r:9200"]
  username: "username"
  password: "password"

  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Then i used filebeat setup -e and everything seems to be right :person_facepalming:

Best regard

Hello ( >﹏<。)
Someone can help pls?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.