Skip to content

Missing mappings in monitoring-logstash-mb template #125499

@ijardillier

Description

@ijardillier

Elasticsearch Version

8.17.3

Installed Plugins

No response

Java Version

bundled

OS Version

Elastic Cloud Service

Problem Description

After each update of our ECS instances, we have to manually add some missing mapping fields in monitoring templates (in this issue, I'll discuss about logstash monitoring template, ie, ".monitoring-logstash-mb")...

We can retrieve the missing field list by adding a data view on the corresponding datastream, is ".monitoring-logstash-*", all missing fields appear in the "Unmapped field" section on the field panel on Discover.

Image

I can push a merge pull request if needed...

Steps to Reproduce

  1. Add metricbeat to monitor a Logstash instance in a Elasticsearch cluster
  2. This will automatically create ".monitoring-logstash-mb" template
  3. Create a dataview on ".monitoring-logstash-*"
  4. Got to Discover and have a look to Unmapped fields in fields panel

Logs (if relevant)

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions