Beats 6.7 dashboards throwing errors on Kibana 7.0

[liza-mae]

Upgrading from current 6.7 snapshot to 7.0 snapshot the beats dashboards are throwing an error. In this case I upgraded my ES and Kibana from 6.7 to 7.0 but I left beats on 6.7, I expect this should work, is beats 6.7 compatible with ES/Kibana 7.0?

Dashboard: Metricbeat and Filebeat System Overview

Object { message: "Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_shard_exception","reason":"failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"query_string\" : {\n \"query\" : \"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"query_string\" : {\n \"query\" : \"beat.name:\\\"packer-virtualbox-iso-1540737293\\\"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : null,\n \"to\" : null,\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n}","index_uuid":"2guIeNdFTYmZeDwc0G721A","index":"metricbeat-6.7.0-2019.01.08"},{"type":"query_shard_exception","reason":"failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"query_string\" : {\n \"query\" : \"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"query_string\" : {\n \"query\" : \"beat.name:\\\"packer-virtualbox-iso-1540737293\\\"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : null,\n \"to\" : null,\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n}","index_uuid":"Y2PlIJROTf-cqQMo2nvQyA","index":"metricbeat-6.7.0-2019.01.09"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"metricbeat-6.7.0-2019.01.08","node":"2lH79ATASCqh6etP8JVpIg","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"query_string\" : {\n \"query\" : \"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"query_string\" : {\n \"query\" : \"beat.name:\\\"packer-virtualbox-iso-1540737293\\\"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : null,\n \"to\" : null,\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n}","index_uuid":"2guIeNdFTYmZeDwc0G721A","index":"metricbeat-6.7.0-2019.01.08","caused_by":{"type":"illegal_argument_exception","reason":"field expansion matches too many fields, limit: 1024, got: 1854"}}},{"shard":0,"index":"metricbeat-6.7.0-2019.01.09","node":"2lH79ATASCqh6etP8JVpIg","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"query_string\" : {\n \"query\" : \"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"query_string\" : {\n \"query\" : \"beat.name:\\\"packer-virtualbox-iso-1540737293\\\"\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : null,\n \"to\" : null,\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n}","index_uuid":"Y2PlIJROTf-cqQMo2nvQyA","index":"metricbeat-6.7.0-2019.01.09","caused_by":{"type":"illegal_argument_exception","reason":"field expansion matches too many fields, limit: 1024, got: 1854"}}}]},"status":400}", stack: "KbnError@https://localhost:5620/bundles/commons.bundle.js:3:10654\nRequestFailure@https://localhost:5620/bundles/commons.bundle.js:3:11093\ncallResponseHandlers/<@https://localhost:5620/bundles/commons.bundle.js:3:1389263\nPromise.try@https://localhost:5620/bundles/commons.bundle.js:3:995922\nPromise.map/<@https://localhost:5620/bundles/commons.bundle.js:3:995283\nPromise.map@https://localhost:5620/bundles/commons.bundle.js:3:995248\ncallResponseHandlers@https://localhost:5620/bundles/commons.bundle.js:3:1388267\nfetchSearchResults/<@https://localhost:5620/bundles/commons.bundle.js:3:1371260\nprocessQueue@https://localhost:5620/dlls/vendors.bundle.dll.js:411:199687\nscheduleProcessQueue/<@https://localhost:5620/dlls/vendors.bundle.dll.js:411:200650\n$digest@https://localhost:5620/dlls/vendors.bundle.dll.js:411:210412\n$evalAsync/<@https://localhost:5620/dlls/vendors.bundle.dll.js:411:212933\ncompleteOutstandingRequest@https://localhost:5620/dlls/vendors.bundle.dll.js:411:64422\nBrowser/self.defer/timeoutId<@https://localhost:5620/dlls/vendors.bundle.dll.js:411:67267\n", origError: false, resp: {…} }

Possibly unhandled rejection: {"message":"Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_shard_exception","reason":"failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"query_string\" : {\n \"query\" : \"*\",\n \"fields\" : [ ],\n \"type\" : \"best_fields\",\n \"default_operator\" : \"or\",\n \"max_determinized_states\" : 10000,\n \"enable_position_increments\" : true,\n \"fuzziness\" : \"AUTO\",\n \"fuzzy_prefix_length\" : 0,\n \"fuzzy_max_expansions\" : 50,\n \"phrase_slop\" : 0,\n \"analyze_wildcard\" : true,\n \"escape\" : false,\n \"auto_generate_synonyms_phrase_query\" : true,\n \"fuzzy_transpositions\" : true,\n \"boost\" : 1.0\n }\n },\n {\n \"query…
vendors.bundle.dll.js:411:155522