Can't push filebeat 6.5.3 index template to Elasticsearch

(Ganchu) #1

I trying Bro logs to logstash using filebeat-6.5.3. So I configured using [https://github.com/mellow-hype/bro-stash](http://this config) and pushing template to elasticsearch
curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat-index-template.json -H 'Content-Type: application/json'.
But got this error.

{ "error" : { "root_cause" : [ { "type" : "mapper_parsing_exception", "reason" : "No handler for type [string] declared on field [message]" } ], "type" : "mapper_parsing_exception", "reason" : "Failed to parse mapping [doc]: No handler for type [string] declared on field [message]", "caused_by" : { "type" : "mapper_parsing_exception", "reason" : "No handler for type [string] declared on field [message]" } }, "status" : 400 }