elasticsearch - filebeat: error creating template: fields contain key <hash>

Question

I am running "docker.elastic.co/beats/filebeat:7.9.1"

In filebeat.yml I configured to append some fields to the template

setup.template.overwrite: true
setup.template.append_fields:
  - name: level
    type: text
  - name: msg
    type: text
  - name: stacktrace
    type: text
  - name: uri
    type: text
  - name: headers
    type: text

This works fine. But as soon as I add the field:

  - name: hash
    type: keyword

I get the following error:

INFO    template/load.go:169    Existing template will be overwritten, as overwrite is enabled.                                                                                                                                                  
ERROR    [publisher_pipeline_output]    pipeline/output.go:154    Failed to connect to backoff(elasticsearch(https://whatever.eu-central-1.aws.cloud.es.io:443)): Connection marked as failed because the onConnect call back failed: error loading template: error creating template: 1 error: fields contain key <hash>

The Elasticsearch version is v7.10.0.

What is going on?

question from:https://stackoverflow.com/questions/65559749/filebeat-error-creating-template-fields-contain-key-hash

Answer 1

The problem is that a field named "hash" is already defined in the "Elastic Common Schema (ECS)" fields in the default "fields.yml" file.

(see: https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-ecs.html)