Shards failures - illegal_argument_exception

Elastic Stack Beats
,
1

I have fresh installation of ELK stack with Filebeat and Metricbeat. When I try to open predefined dashboard (for example "[Filebeat System] SSH login attempts ECS"), I see many shard failures:

Fielddata is disabled on [system.auth.ssh.method] in [filebeat-8.5.3-2023.04.19].
Fielddata is disabled on [host.name] in [metricbeat-8.5.3-2023.04.19].
Fielddata is disabled on [host.hostname] in [filebeat-8.5.3-2023.04.19].
Fielddata is disabled on [user.name] in [filebeat-8.5.3-2023.04.19].

I tried 8.5.3, 8.6.2 and 8.7.0 version - for all of those I have the same results.

Dashboards are configured during beats setup:

metricbeat setup --dashboards --index-management
filebeat setup --dashboards --index-management

What can I check to solve the issue?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.