# Shards failures - illegal\_argument\_exception

**URL:** <https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311>\
**Category:** Beats\
**Tags:** filebeat, metricbeat\
**Created:** [April 19, 2023, 2:03pm UTC](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311 "2023-04-19T14:03:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dpecak](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@dpecak](https://discuss.elastic.co/u/dpecak)\
**Post date:** [April 19, 2023, 2:03pm UTC](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311/1 "2023-04-19T14:03:17Z")

</div>

I have fresh installation of ELK stack with Filebeat and Metricbeat. When I try to open predefined dashboard (for example "[Filebeat System] SSH login attempts ECS"), I see many shard failures:

```auto
Fielddata is disabled on [system.auth.ssh.method] in [filebeat-8.5.3-2023.04.19].
Fielddata is disabled on [host.name] in [metricbeat-8.5.3-2023.04.19].
Fielddata is disabled on [host.hostname] in [filebeat-8.5.3-2023.04.19].
Fielddata is disabled on [user.name] in [filebeat-8.5.3-2023.04.19].

```

I tried 8.5.3, 8.6.2 and 8.7.0 version - for all of those I have the same results.

Dashboards are configured during beats setup:

```auto
metricbeat setup --dashboards --index-management
filebeat setup --dashboards --index-management

```

What can I check to solve the issue?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2023, 4:04pm UTC](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311/2 "2023-05-17T16:04:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.