So I'm running into this problem that a few others on this board have had problems with in the past. I'm somewhat confused about the problem so maybe someone could spend a minute or two to help understand the issue or point me in a documentation direction that explains it.
I've setup my cluster, logstash, kibana and I've installed Metricbeat on a server to start ingesting data. I loaded the metricbeat template in Elasticsearch as well as loading the pre-canned visualization templates that also come with it. However several of the visualizations give me the following error:
The request for this panel failed. The aggregations key is missing from the response, check your permissions for this request.
I have the basic license installed so from what I'm reading in the docs, while X-Pack is installed, security is by default turned off. I then came across this post:
Seems that it's not a permissions issue and that Fielddata is by default set to false. I ran the code found here in 6.4.2 and my visualizations started working.
However, I've since upgraded to 6.5.1 which has now broken the visualizations again. I re-ran the code found on the page but it has not (re)fixed the problem. Which now leads me to a few questions:
First, simply how to I fix what the upgrade broke? Second, based on what is written on the fielddata page, it seems that this practice isn't a good idea or at least isn't scalable. So either why wasn't a keyword field used in the Metricbeat template OR why didn't the visualization templates warn of this problem and provide avenues of resolution?
I feel like this is an error in my understanding the software. if someone could point me in a documentation direction, I would greatly appreciate it.