<p>I'm deploying filebeat in kubernetes using the k8s manifests from here: <a href="https://raw.githubusercontent.com/elastic/beats/7.5/deploy/kubernetes/filebeat-kubernetes.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/elastic/beats/7.5/deploy/kubernetes/filebeat-kubernetes.yaml</a></p>

<p>The filebeat template is loaded into elasticsearch, but the mappings for nginx module are incomplete:</p>

<pre><code>"nginx" : {
  "properties" : {
    "access" : {
      "properties" : {
        "geoip" : {
          "type" : "object"
        },
        "user_agent" : {
          "type" : "object"
        }
      }
    },
    "error" : {
      "properties" : {
        "connection_id" : {
          "type" : "long"
        }
      }
    }
  }
},
</code></pre>

<p>Most of the nginx properties defined in the fields.yaml are aliases and none of the properties defined as an alias are getting their way into the filebeat template.</p>

<p>Is there something I'm missing as part of the filebeat configuration ?</p>

<p>I also tried with my custom fields.yaml where I replaced the aliases with their concrete definition and the elasticsearh loaded mapping looks good.</p>

Laurentiu Soica
<p>As pointed out by Elastic's Marcin Tojek in Elastic community thread &quot;<a href="https://discuss.elastic.co/t/filebeat-versions-from-7-0-7-8-fail-to-create-alias-field-mappings-for-majority-of-modules/242874/" rel="nofollow noreferrer">Filebeat Filebeat versions from 7.0 - 7.8 fail to create alias field mappings for majority of modules</a>&quot; the Beats Platform Reference 7.8, chapter Upgrade, section <a href="https://www.elastic.co/guide/en/beats/libbeat/current/upgrading-6-to-7.html" rel="nofollow noreferrer">Upgrade from 6.x to 7.x</a> states the following:</p>
<blockquote>
<p>Starting with 7.0, the fields exported by Beats conform to the <a href="https://www.elastic.co/guide/en/ecs/1.5/index.html" rel="nofollow noreferrer">Elastic Common Schema (ECS)</a>. Many of the exported fields have been renamed. See <a href="https://www.elastic.co/guide/en/beats/libbeat/7.8/breaking-changes-7.0.html" rel="nofollow noreferrer">Breaking changes in 7.0</a> for the full list of changed names.</p>
<p>To help you transition to the new fields, we provide a compatibility layer in the form of ECS-compatible field aliases. To use the aliases, set the following option in the Beat’s configuration file before you upgrade the Elasticsearch index template to 7.0.</p>
<p><code>migration.6_to_7.enabled: true</code>
The field aliases let you use 6.x dashboards and visualizations with indices created by Beats 7.0 or later. The aliases do <strong>not</strong> work with saved searches or with API calls that manipulate documents directly.</p>
</blockquote>
<p>Note that as of 2020-07-29 neither the Filebeats Reference 7.8 chapter <a href="https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields.html" rel="nofollow noreferrer">Exported fields</a> mentions this nor do the Filebeat modules' sections which still list all of the aliases which do not get created by default anymore on fresh installations unless explicitly enabling &quot;<code>migration.6_to_7.enabled: true</code>&quot;.</p>
