Could not index event to Elasticsearch after upgrade to 7.0.1

Elastic Stack Logstash
1

Hello,

I have this following error since upgrade from 6.7.1 to 7.0.1 :

[2019-06-20T11:21:04,154][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"f5-2019.06.20", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x4f935ae3>], :response=>{"index"=>{"_index"=>"f5-2019.06.20", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"The [default] mapping cannot be updated on index [f5-2019.06.20]: defaults mappings are not useful anymore now that indices can have at most one type."}}}}

I tried to remove old logstash template but issue is still present

It seems to be an issue about template and maybe mapping, but i don't find why

Any help ?

2

I found the issue.

We had some other template who used the default logstash template.
We solve the issue by removing the template using logstash and logstash template.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.