An index called logstash

Elastic Stack Elasticsearch
1

I have noticed the since the upgrade from 6.x to 7.x that indexes had errors with their lifecycle policies.

illegal_argument_exception: index.lifecycle.rollover_alias [logstash] does not point to index [logstash-2020.02.10]

How ever my attempt to fix this has now meant I am not seeing any new logs at all

In logstash logs I see

[2020-02-19T14:13:30,228][ERROR][logstash.outputs.elasticsearch][main] Encountered a retryable error. Will Retry with exponential backoff  {:code=>400, :url=>"http://s08.at.sdlocal.net:9200/_bulk"}
[2020-02-19T14:13:30,371][ERROR][logstash.outputs.elasticsearch][main] Encountered a retryable error. Will Retry with exponential backoff  {:code=>400, :url=>"http://s08.at.sdlocal.net:9200/_bulk"}
[2020-02-19T14:14:31,601][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x4b44b509>], :response=>{"index"=>{"_index"=>"logstash", "_type"=>"_doc", "_id"=>"K8xwW3ABasizqXEkmi7-", "stat
us"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [response] of different type, current_type [long], merged_type [text]"}}}}

I also notice there is an actual index called logstash (which seems to have content).

I am unsure what to next from here. Can I have any thoughts?

2

Do I delete this index called logstash or is that the alias?

3

Out of desperation I stopped logstash, deleted the index added a new write index alias to the newest of the logstash indexes and restarted logstash.

While this has restored the flow of logs, I am left with my orignal problem. How do I did the illegal_argument_exception: index.lifecycle.rollover_alias [logstash] does not point to index [logstash-2020.02.10] errors? I assume now that there is something / wrong with my logstash configuration.

4

I'm closing this as this topic as the problem that caused be open this is fixed. I'll search other topics for my index error issues

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.