Automatically update index template in Logstash

Hello! I added new fields in an index template file and set template_overwrite => true, but Logstash didn't update the new template and shows mapping error. Is there a way to update an index template directly by Logstash?

Error:

[2019-04-22T19:01:57,545][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"success-2019", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x2b56411>], :response=>{"index"=>{"_index"=>"success-2019", "_type"=>"doc", "_id"=>"qHntR2oBp6bT1-SkpJwk", "status"=>400, "error"=>{"type"=>"strict_dynamic_mapping_exception", "reason"=>"mapping set to strict, dynamic introduction of [rollout] within [doc] is not allowed"}}}}

rollout is the new field I try to add and I used strict mapping in the index template.

pipeline.conf

input {
    beats {
        port => "5044"
    }
}

filter {
  ruby {
    path => "./parse_log.rb"
  }
}

output {
  stdout { codec => rubydebug }
  elasticsearch {
    template => "./success.json"
    template_name => "success"
    template_overwrite => "true"
    hosts => [ "localhost:9200" ]
    index => "success-%{+yyyy}"
  }
}

success.json

{
  "template": "success",
  "index_patterns": ["success-*"],
  "mappings": {
    "doc": {
      "dynamic": "strict",
      "properties": {
        "@timestamp" : {"type" : "date"},
        "@version" : {"type" : "keyword"},
        "source" : {"type" : "keyword"},
        "hash" : {"type" : "keyword"},
        "rollout": {"type": "boolean"}
      }
    }
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.