search

elastic / ecs

Elastic Common Schema
https://www.elastic.co/what-is/ecs
Apache License 2.0
987 stars 410 forks source link

Elastic-Agent Integrations Use of Legacy Mapping Types Impacts .fleet_globals & prevents agents from being upgraded #2302

Open iamhowardtheduck opened 7 months ago

iamhowardtheduck commented 7 months ago

Out-of-the-box integrations use legacy mapping types in their component templates.

If you enable the mapper_size plugin, then go to apply it in .fleet_globals, this error message occurs:

Unable to create component template updating component template [.fleet_globals-1] results in invalid composable template [COMPONENT-TEMPLATES-HERE-PER-EACH-INTEGRATION] after templates are merged

image image

Then go look at the specific integration component template mapping section: image

Link goes here from component template: https://www.elastic.co/guide/en/elasticsearch/reference/8.11/removal-of-types.html

If an Elastic-Agent was installed, .fleet_globals was modified to display the _size field, then that agent will not upgrade and be stuck on that version.