Troubleshoot mapping issues

There are situations in which Heartbeat data can be indexed without the correct mappings applied. These situations cannot occur with the Elastic Agent configured via Fleet, only with standalone Heartbeat or Elastic Agent running in standalone mode. This can occur when the underlying heartbeat-VERSION ILM alias is deleted manually or when Heartbeat writes data through an intermediary such as Logstash without the setup command being run. When running Elastic Agent in standalone mode this can happen if manually setup datastreams have incorrect mappings.

To fix this problem, you typically need to remove your Heartbeat indices and datastreams. Then you must create new ones with the appropriate mappings installed. To achieve this, follow the steps below.

It is necessary to stop all Heartbeat/Elastic Agent instances that are targeting the cluster, so they will not write to or re-create indices prematurely.

To ensure the mapping is applied to all Heartbeat data going forward, delete all the Heartbeat indicies that match the pattern the Uptime app will use.

There are multiple ways to achieve this. You can read about performing this using the Index Management UI or with the Delete index API.

If using Elastic Agent you will want to fix any issues with custom datastream mappings. We encourage the use of fleet to eliminate this issue.

The below command will cause Heartbeat to perform its setup processes and recreate the index template properly.

heartbeat setup -e

heartbeat setup -e

./heartbeat setup -e

heartbeat setup -e

./heartbeat setup -e

PS > .\heartbeat.exe setup -e

This command performs the necessary startup tasks and ensures that your indicies have the appropriate mapping going forward.

Now, when you run Heartbeat/Elastic Agent, your data will be indexed with the appropriate mappings. When the Uptime app attempts to fetch your data, it should be able to render without issues.