Can not index events after upgrade

Elastic Stack Beats
1

I am having the following issue:

2018-01-11T08:56:58Z WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters:  [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters:  [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}

Furthermore the configuration looks very simple:

- type: log
  enabled: true
  paths:
    - /var/log/messages
    - /var/log/secure

setup.kibana:
      host: "kibanahost:5601"

output.elasticsearch:
      # Array of hosts to connect to.
      hosts: ["host1:9200", "host2:9200", "host3:9200" ]
      loadbalance: true
      worker: 3
      pipeline: logs
      # Optional protocol and basic auth credentials.
      #protocol: "https"
      #username: "elastic"
      #password: "changeme"

Version: 6.1.1
Issue started after the upgrade from 5.6 to 6.1.1

I am still not able to post anything to elasticsearch.

Please advise.

2

Hey, can you post here the output of GET _template/filebeat?

3

This topic was automatically closed after 21 days. New replies are no longer allowed.