Deploy zeebe with a elasticserch version 7

Question

I am trying to deploy zeebe cluster and operate on kubernetes with an external elasticsearch. The problem is that the version of elasticsearch is 7.9.2 but according to the documentation, it is only compatible with elasticsearch 6.8.13 and when reviewing the logs I get this message:

{"error":{"root_cause":[{"type":"parse_exception","reason":"failed to parse date field [2021-01-27T20:16:30.802+0000] with format [date_time]: [failed to parse date field [2021-01-27T20:16:30.802+0000] with format [date_time]]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"operate-operation-0.26.0_","node":"3bbob-UKTBuU71ucWEHbtg","reason":{"type":"parse_exception","reason":"failed to parse date field [2021-01-27T20:16:30.802+0000] with format [date_time]: [failed to parse date field [2021-01-27T20:16:30.802+0000] with format [date_time]]","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [2021-01-27T20:16:30.802+0000] with format [date_time]","caused_by":{"type":"date_time_parse_exception","reason":"Text '2021-01-27T20:16:30.802+0000' could not be parsed at index 23"}}}}]},"status":400}

I see that the problem is due to the format of the date field. Is there a way to fix that error?

Answer 1

According to this discussion on Zeebe forum and the linked quite old issue (Support Elasticsearch 7 #3445) it really still does not support elasticsearch 7. And this date error was reported in the issue:

Operate works for the most part on ELK 7.6 - the issues arise when trying to manage workflows instances in the UI (e.g. cancel or retry) - it throws a bunch of errors and keeps spinning indefinitely (same as with ELK log when adding stuff to Zeebe indices):

Caused by: org.elasticsearch.ElasticsearchParseException: failed to parse date field [2020-05-06T23:46:34.477-0400] with format [date_time]: [failed to parse date field [2020-05-06T23:46:34.477-0400] with format [date_time]]

Looks like you should downgrade your elasticsearch to version 6.8.13 or wait when the developer will have more time to fix this.