[2019-09-22T09:37:34,941][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2019.09.22", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x4528d597>], :response=>{"index"=>{"_index"=>"logstash-2019.09.22",…

Have a look at these: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/copy-to.html https://www.elastic.co/guide/en/elasticsearch/reference/6.8/mapping-all-field.html [image] Space Saving Improvements in Elasticsearch 6.0 Two upcoming improvements will help minimize Elasticse…

Could not index event to Elasticsearch after upgrade

Elastic Stack Logstash

hackdefendr (Jeff Singleton) September 22, 2019, 3:15pm 5

Thanks for that. I'm having trouble understanding the copy_to part. I'm afraid I need elasticsearch for dummies . I found in the Kibana 7.0 Upgrade Assistant a place to reindex, but it errors out due to not having a custom _all field.

Topic		Replies	Views
[include_in_all] is not allowed for indices (after upgrading to 6.0.0) Logstash	3	3971	January 1, 2018
Mapper_parsing_exception", "reason"=>"[include_in_all - is not allowed for indices created on or after version 6.0.0 Logstash	7	5322	December 27, 2017
5.6 -> 6.1 Upgrade logstash template woes (SOLVED) Elasticsearch	2	1182	January 31, 2018
Logstash cannot index to Elasticsearch Logstash	7	975	May 17, 2018
ES Cloud: How to fix [include_in_all] is not allowed for indices created on or after version 6.0.0 Elastic Cloud Enterprise (ECE)	2	1745	November 30, 2017

Could not index event to Elasticsearch after upgrade

Related topics