[Auditbeat] Error process.entity_id is duplicated error running setup #17042
Comments
liza-mae
added
bug
Auditbeat
Team:Services
|
Pinging @elastic/integrations-services (Team:Services) |
ycombinator
added
Team:SIEM
and removed
Team:Services
|
Pinging @elastic/siem (Team:SIEM) |
adriansr
added a commit
to adriansr/beats
that referenced
this issue
Mar 18, 2020
Auditbeat was declaring this field before it was introduced in ECS 1.5 leading to duplication. Fixes elastic#17042
adriansr
added a commit
that referenced
this issue
Mar 18, 2020
Auditbeat was declaring this field before it was introduced in ECS 1.5 leading to duplication. Fixes #17042
|
@adriansr thanks for the fix, this needs to be backported to 7.x please. |
|
@liza-mae yes, the backport is on its way 👍 |
|
Thank you @adriansr :) ! |
adriansr
added a commit
to adriansr/beats
that referenced
this issue
Mar 19, 2020
Auditbeat was declaring this field before it was introduced in ECS 1.5 leading to duplication. Fixes elastic#17042 (cherry picked from commit f01a126)
adriansr
added a commit
that referenced
this issue
Mar 19, 2020
|
Backlog grooming: Closing it for now until further activity, can still be reopened if needed. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Running auditbeat setup is throwing an error:
Overwriting ILM policy is disabled. Set
setup.ilm.overwrite:truefor enabling.Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Exiting: error generating index pattern: field <process.entity_id> is duplicated, remove it or set 'overwrite: true', {Name:entity_id Type:keyword Description:ID uniquely identifying the process. It is computed as a SHA-256 hash of the host ID, PID, and process start time.
Format: Fields:[] MultiFields:[] Enabled: Analyzer: SearchAnalyzer: Norms:false Dynamic:{Value:} Index: DocValues: CopyTo: IgnoreAbove:0 AliasPath: MigrationAlias:false Dimension: ObjectType: ObjectTypeMappingType: ScalingFactor:0 ObjectTypeParams:[] Analyzed: Count:0 Searchable: Aggregatable: Script: Pattern: InputFormat: OutputFormat: OutputPrecision: LabelTemplate: UrlTemplate:[] OpenLinkInCurrentTab: Overwrite:false DefaultField: Path:process.entity_id}, {"aggregatable":true,"analyzed":false,"count":0,"doc_values":true,"indexed":true,"name":"process.entity_id","scripted":false,"searchable":true,"type":"string"}
The text was updated successfully, but these errors were encountered: