Troubleshoot mapping issues

edit
Mapping issues
edit

There are situations in which Heartbeat data can be indexed without the correct mappings applied. These situations cannot occur with the Elastic Agent configured via Fleet, only with standalone Heartbeat or Elastic Agent running in standalone mode. This can occur when the underlying heartbeat-VERSION ILM alias is deleted manually or when Heartbeat writes data through an intermediary such as Logstash without the setup command being run. When running Elastic Agent in standalone mode this can happen if manually setup datastreams have incorrect mappings.

To fix this problem, you typically need to remove your Heartbeat indices and datastreams. Then you must create new ones with the appropriate mappings installed. To achieve this, follow the steps below.

Stop your Heartbeat/Elastic Agent instances
edit

It is necessary to stop all Heartbeat/Elastic Agent instances that are targeting the cluster, so they will not write to or re-create indices prematurely.

Delete your Heartbeat indices / Elastic Agent datastreams
edit

To ensure the mapping is applied to all Heartbeat data going forward, delete all the Heartbeat indicies that match the pattern the Uptime app will use.

There are multiple ways to achieve this. You can read about performing this using the Index Management UI or with the Delete index API.

If using Elastic Agent you will want to fix any issues with custom datastream mappings. We encourage the use of fleet to eliminate this issue.

If using Heartbeat, perform Heartbeat setup
edit

The below command will cause Heartbeat to perform its setup processes and recreate the index template properly.

For more information on how to use this command, you can reference the Heartbeat quickstart guide.

heartbeat setup -e

This command performs the necessary startup tasks and ensures that your indicies have the appropriate mapping going forward.

Run Heartbeat/Elastic Agent again
edit

Now, when you run Heartbeat/Elastic Agent, your data will be indexed with the appropriate mappings. When the Uptime app attempts to fetch your data, it should be able to render without issues.