Hello! I added new fields in an index template file and set template_overwrite => true
, but Logstash didn't update the new template and shows mapping error. Is there a way to update an index template directly by Logstash?
Error:
[2019-04-22T19:01:57,545][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"success-2019", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x2b56411>], :response=>{"index"=>{"_index"=>"success-2019", "_type"=>"doc", "_id"=>"qHntR2oBp6bT1-SkpJwk", "status"=>400, "error"=>{"type"=>"strict_dynamic_mapping_exception", "reason"=>"mapping set to strict, dynamic introduction of [rollout] within [doc] is not allowed"}}}}
rollout is the new field I try to add and I used strict mapping in the index template.
pipeline.conf
input {
beats {
port => "5044"
}
}
filter {
ruby {
path => "./parse_log.rb"
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
template => "./success.json"
template_name => "success"
template_overwrite => "true"
hosts => [ "localhost:9200" ]
index => "success-%{+yyyy}"
}
}
success.json
{
"template": "success",
"index_patterns": ["success-*"],
"mappings": {
"doc": {
"dynamic": "strict",
"properties": {
"@timestamp" : {"type" : "date"},
"@version" : {"type" : "keyword"},
"source" : {"type" : "keyword"},
"hash" : {"type" : "keyword"},
"rollout": {"type": "boolean"}
}
}
}
}