Advice for changing my primary data template

Elastic Stack Elasticsearch
1

Hi. I have noticed I am getting vast numbers of logs telling me I am using a deprecated field type:

[2017-07-13T14:49:09,313][WARN ][org.elasticsearch.deprecation.common.ParseField] Deprecated field [type] used, replaced by [match_phrase and match_phrase_prefix query]

I have seen somewhere that this is due to a template field mapping, which makes sense as within my dynamic template I have the following:

{
  "message_field": {
    "mapping": {
      "fielddata": {
        "format": "disabled"
      },
      "index": "analyzed",
      "omit_norms": true,
      "type": "string"
    },
    "match_mapping_type": "string",
    "match": "message"
  }
}

Is the fix a simple change as per the error message, or am I going to potentially break stuff here? Or am I looking in the wrong place?

Thanks

2

I am assuming you are using the version 5.x, The string field is unsupported for indexes created in 5.x in favor of the text and keyword fields. You can find more details in this blog Strings are dead, long live strings! .
After changing the template mapping all new indices you will create will use the new mapping. for old indices created before the version 5.0 you will need to reindex them with the reindex api

Regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.