search

Icinga / icingabeat

Elastic Beat fetching events & status from Icinga 2
https://icinga.com/docs/icingabeat/latest
Apache License 2.0
33 stars 13 forks source link

Don't use the reserved `host` field anymore #26

Closed widhalmt closed 5 years ago

widhalmt commented 6 years ago

In 6.4 versions Elasticsearch invented a reserved nested field host.

When Icingabeat connects directly to Elasticsearch it wants to write into the field host like it has done before. (And like almost any user does :-( ) But Elasticsearch will refuse to write the new data into an index.

Please change icingabeat so it won't write a "host" field anymore.

/ref/NC/558885

widhalmt commented 6 years ago

Here is the interesting part out of the logfile:

"reason":"failed to parse [host]","caused_by":{"type":"illegal_state_exception","reason":"Can't get text on a START_OBJECT at 1:49"}}

Can't paste all of the log because there's some company data in it.

bobapple commented 6 years ago

This may be related to https://github.com/Icinga/icingabeat/issues/25

5nafu commented 6 years ago

I had this issue when downgrading to 6.1.1 as well (with Elastic 5.5), but this was due to the fact that there are two field definitions for "host" in the icingabeat template. I first changed only one instance and got this issue.

bobapple commented 5 years ago

I moved all icinga related fields to an icinga group, this will solve the issue.