Can't create a new index in elasticsearch

Elastic Stack Logstash
1

hi, i'm new in logstash and I would try to index my apache logs in elasticsearch 5.4.3. I have followed this guide on official es blog: https://www.elastic.co/blog/logstash_lesson_elasticsearch_mapping

When I try to create an index with that command:
head -50 /var/log/apache2/access_log | /usr/share/logstash/bin/logstash -f above_sample.conf
I get this error:
11:59:53.998 [[main]>worker4] WARN logstash.outputs.elasticsearch - Could not index event to Elasticsearch. {:status=>404, :action=>["index", {:_id=>nil, :_index=>"my_index", :_type=>"mytype", :_routing=>nil}, 2018-02-25T11:08:51.000Z michele-desktop %{message}], :response=>{"index"=>{"_index"=>"my_index", "_type"=>"mytype", "_id"=>"AWHhN-FTij9MjQt45fC4", "status"=>404, "error"=>{"type"=>"type_missing_exception", "reason"=>"type[mytype] missing", "index_uuid"=>"PMwuOKH7SuGlU-B90UaQiA", "index"=>"my_index", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"trying to auto create mapping, but dynamic mapping is disabled"}}}}}

I have tried to enable index.mapper.dynamyc adding a rule in my elasticsearch.yml. But it returns to me an error if I type sudo service elasticsearch status:

    In order to upgrade all indices the settings must be updated via the 
    /${index}/_settings API. Unless all settings are dynamic all indices must be closed 
    in order to apply the upgradeIndices created in the future should use index templates 
    to set default values.

So I have tried to enable that parameter via api request:

PUT _settings
{
  "index.mapper.dynamic": true
}

and creating a new template on elastic, sending this json to the api endpoint:

PUT _template/template_2
{
    "template": "my_index",
    "settings": {"index.refresh_interval": "-1"},
    "mappings": {
        "_default_": {
            "_all": {"enabled": false},
            "date_detection": false,
            "dynamic_templates": [
                {"string_fields": {
                    "match": "*",
                    "match_mapping_type": "string",
                    "mapping": {"type": "keyword"}
                }}
            ],
            "properties": {
                "@timestamp": {"type": "date", "format": "dateOptionalTime"},
                "agent": {"type": "text", "fields": {"raw": {"type": "keyword"}}},
                "referrer": {"type": "text", "fields": {"raw": {"type": "keyword"}}},
                "request": {"type": "text", "fields": {"raw": {"type": "keyword"}}},
                "host": {"type": "keyword"},
                "httpversion": {"type": "keyword"},
                "bytes": {"type": "long"},
                "response": {"type": "short"},
                "clientip": {"type": "ip"},
                "geoip": {
                    "type": "object", "dynamic": true,
                    "properties": {"location": {"type": "geo_point"}}
                }
            }
        }
    }
}

But I can't resolve my error. What can I try?
Thanks in advance

2

You'll have better luck asking this question in the Elasticsearch group.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.