Where do get filebeat.template-es6x.json

Elastic Stack Beats
1

I am having a similar issue as posted here:

But my filebeat is running on windows.

The post suggests using filebeat.template-es6x.json. However I cannot find it my downloaded resource.
I had to run a script to export a template even.

I am using filebeat 6.1.2 and elasticsearch 6.x. Using filebeat default configuration.

    filebeat.prospectors:
    - type: log
      enabled: true
      paths:
        - c:\path
    filebeat.config.modules:
      path: ${path.config}/modules.d/*.yml
      reload.enabled: false
    setup.template.settings:
      index.number_of_shards: 3
    setup.kibana:
      host: "kibana:5601"
    output.elasticsearch:
      hosts: ["elk:9200"]

The exact error is:

WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}

_template/filebeat returns this:
https://pastebin.com/Jb9bAxUS

_template/filebeat-*/_mapping
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"request [/_template/filebeat-*/_mapping] contains unrecognized parameter: [name]"}],"type":"illegal_argument_exception","reason":"request [/_template/filebeat-*/_mapping] contains unrecognized parameter: [name]"},"status":400}

2

The template.json files are gone with 6.0. Instead beats ships fields.yml file, with all fields being exported. This file is used to generate the template, matching the Elasticsearch version used. Running filebeat export template --es.version <version> will print a json template, compatible with the Elasticsearch version selected.

Did you upgrade from an older beats version? The type of the error field has been changed in 6.0 as well. Looks like an old template is still applied here.

Check all templates and delete old ones before restarting. You will need to delete todays index as well, as a template are only applied when indices are created.

3

Okay fixed. It was indeed the issue with old template as suggested in the quoted post.

Here are the steps taken:

  1. Delete old template Invoke-RestMethod -Method Delete "http://uks-elk-01-p:9200/filebeat-*"
  2. Delete old filebeat index in kibana
  3. Export new template: .\filebeat.exe export template --es.version 6.1.2 | Out-File -Encoding UTF8 filebeat.template.json
  4. Copy the new template over Invoke-RestMethod -Method Put -ContentType "application/json" -InFile filebeat.template.json -Urihttp://elk:9200/_template/filebeat`

Thanks everyone and the original quoted poster for helping fix this.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.