使用Metricbeat監控zookeeper遇到的問題

1.metricbeat中啟動自動加載模塊

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

2.開啟kibana中的dashboard功能

setup.dashboards.enabled: true

然后啟動metricbeat

3.啟動zookeeper模塊

./metricbeat modules enable zookeeper

會看到目錄modules.d下的zookeeper.yml.disabled變成zookeeper.yml

4.編輯zookeeper.yml,配置上監聽的zookeeper地址

- module: zookeeper
  metricsets:
    - mntr
    - server
  period: 10s
  hosts: ["172.17.107.187:2181","172.17.107.187:2182","172.17.107.187:2183"]

5.在kibana web界面創建索引metricbeat-7.3.0*模式

6.在kibana左側導航儀表盤搜索zookeeper,出現如下信息，點開查看：

注意：若是出現如下之類的錯誤提示,可以按照文章(https://www.cnblogs.com/sanduzxcvbnm/p/12172935.html)說的方法進行修改

[esaggs] > Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [zookeeper.server.version_date] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"metricbeat-7.3.0","node":"VD2R4MIiQEOh1rlL5YU2ow","reason":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [zookeeper.server.version_date] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}],"caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [zookeeper.server.version_date] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.","caused_by":{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [zookeeper.server.version_date] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}}},"status":400}

7.但是在查看儀表盤中的[Metricbeat System] Overview ECS時出現的問題，卻不知道要如何解決？
問題如下：

• 當刷新這個儀表盤界面時會出現如下的提示：

"reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [zookeeper.server.version_date

但是按照上一步說的執行如下命令后：

PUT metricbeat-7.3.0/_mapping
{
  "properties": {
    "zookeeper": {
      "properties": {
        "server": {
            "properties": {
                "version_date":{
                    "type": "text",
                    "fielddata": true,
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                }
            }
        }
      }
    }
  }
}

這個錯誤不會出現了，但是會出現另一個錯誤：

"type":"illegal_argument_exception","reason":"Field [zookeeper.server.version_date] of type [text] does not support custom formats"

究其原因就是 [zookeeper.server.version_date] 的類型問題
官方給的該字段的參考值如下：

官方給的該字段的類型是：

創建索引時生成的mapping中該字段類型是text。
儀表盤中會使用到該字段進行聚合查詢，因為默認的text類型沒有開啟fielddata=true。
開啟后但是會出現字段類型的錯誤。

修改字段類型是date,這一步是無法進行操作的,報錯：

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "mapper [zookeeper.server.version_date] of different type, current_type [text], merged_type [date]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "mapper [zookeeper.server.version_date] of different type, current_type [text], merged_type [date]"
  },
  "status": 400
}

修改字段類型是date,並且開啟fielddata=true。這一步也是無法進行操作的，報錯：

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Mapping definition for [version_date] has unsupported parameters:  [fielddata : true]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Mapping definition for [version_date] has unsupported parameters:  [fielddata : true]"
  },
  "status": 400
}

能做的操作就是給text類型開啟fielddata=true。

感覺陷入死循環了，不修改不行，修改也不行。。。