кибана [нелегальная_аргумент_эксклюзия]

Question

Я собираю последний кластер elk (v7.3.2) для тестирования, но когда я закончил его создание и добавил индекс в kibana. Я получаю сообщение об ошибке из журнала kibana: [illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [type] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternyword field instead. Я погуглил некоторые решения, выяснил, почему изсайт: https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html и изменил его на ключевое слово, как говорит веб, но я получил следующую ошибку.

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Mapping definition for [@timestamp] has unsupported parameters:  [fielddata : true]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Mapping definition for [@timestamp] has unsupported parameters:  [fielddata : true]"
  },
  "status": 400
}

кто-то помог

есть мой файл конфигурации биения:

    filebeat.inputs:
    - type: log
      tail_files: true
      paths:
        - /var/log/cyk213.log
      fields:
        appid: appid_cyk_filebeat_config_output.kafka_cyk_213
    output.kafka:
      hosts: 
["10.201.5.213:9092","10.201.5.213:9093","10.201.5.216:9092","10.201.5.216:9093","10.201.5.217:9092","10.201.5.217:9093"]
      topic: 'topic_cyk_filebeat_config_output.kafka_cyk_213'
      partition.round_robin:
      reachable_only: false
      required_acks: 1
      compression: gzip
      max_message_bytes: 1000000

и конфигурацияasticsearch ниже:

 cluster.initial_master_nodes:
    - es_cluster_node01
    - es_cluster_node02
    cluster.name: cyk_es_cluster
    node.name: es_cluster_node03
    node.master: false
    node.data: true
    path.data: /data/elasticsearch/data
    path.logs: /data/elasticsearch/logs
    bootstrap.memory_lock: false
    bootstrap.system_call_filter: false
    network.host: 0.0.0.0
    http.port: 9200
    transport.profiles.default.port: 9300
    discovery.seed_hosts: ["es_cluster_node03","es_cluster_node02","es_cluster_node01"]
    #discovery.zen.minimum_master_nodes: 2
    discovery.zen.ping_timeout: 150s
    discovery.zen.fd.ping_retries: 10
    client.transport.ping_timeout: 60s
    http.cors.enabled: true
    http.cors.allow-origin: “*”
    logger.org.elasticsearch.cluster.coordination: TRACE

также конфигурация kibana:

    server.port: 5601
    server.host: "0.0.0.0"
    elasticsearch.hosts: "http://10.201.5.217:9200"

---

@ Деян Марич, есть мое отображение:

  "appid_cyk_filebeat_config_output.kafka_cyk_213-2019.10.16" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "agent" : {
          "properties" : {
            "ephemeral_id" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "hostname" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "id" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "type" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "version" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "ecs" : {
          "properties" : {
            "version" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "fields" : {
          "properties" : {
            "appid" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "host" : {
          "properties" : {
            "name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "input" : {
          "properties" : {
            "type" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "log" : {
          "properties" : {
            "file" : {
              "properties" : {
                "path" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            },
            "offset" : {
              "type" : "long"
            }
          }
        },
        "message" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "creation_date" : "1571204138225",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "E_ulQ3NCQQaRTZDTpcO_DQ",
        "version" : {
          "created" : "7030299"
        },
        "provided_name" : "appid_cyk_filebeat_config_output.kafka_cyk_213-2019.10.16"
      }
    }
  }
}

Answer 1

Попробуйте добавить шаблон для ваших шаблонов индекса:

PUT _template/appid_cyk_filebeat_template
{
  "index_patterns": [
    "appid_cyk_filebeat_config_otuput.kafka*"
  ],
  "settings": {
    "index": {
      "number_of_replicas": "1",
      "number_of_shards": "1"
    }
  },
  "mappings": {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "keyword"
        },
        "agent" : {
          "properties" : {
            "ephemeral_id" : {
              "type" : "text"
            },
            "hostname" : {
              "type" : "text"
            },
            "id" : {
              "type" : "text"
            },
            "type" : {
              "type" : "text"
            },
            "version" : {
              "type" : "text"
            }
          }
        },
        "ecs" : {
          "properties" : {
            "version" : {
              "type" : "text"
            }
          }
        },
        "fields" : {
          "properties" : {
            "appid" : {
              "type" : "text"
            }
          }
        },
        "host" : {
          "properties" : {
            "name" : {
              "type" : "text"
            }
          }
        },
        "input" : {
          "properties" : {
            "type" : {
              "type" : "text"
            }
          }
        },
        "log" : {
          "properties" : {
            "file" : {
              "properties" : {
                "path" : {
                  "type" : "text"
                }
              }
            },
            "offset" : {
              "type" : "long"
            }
          }
        },
        "message" : {
          "type" : "text"
        }
      }
  }
} 

Вы можете добавить новый документ в индекс сейчас:

PUT appid_cyk_filebeat_config_otuput.kafka/_doc/1
{
  "@timestamp" : "2019-09-10"
}

{
  "_index" : "appid_cyk_filebeat_config_otuput.kafka",
  "_type" : "_doc",
  "_id" : "2",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "failed" : 0
  },
  "_seq_no" : 1,
  "_primary_term" : 1
}

Если вы не получаете его через Beats/ Logstash или что бы вы ни использовали, ваша конфигурация не годится.