_data_stream_timestamp conflicts?

Does anyone know what this means please? I get this on every attempt Logstash makes to index an event.

"reason"=>"Mapper for [_data_stream_timestamp] conflicts with existing mapper:\n\tCannot update parameter [enabled] from [true] to [false]"

This my first attempt to use a "data stream". I don't know what _data_stream_timestamp is, I haven't set it to anything, and I can't find any documentation on it.

The Logstash output configuration is

    output {
      elasticsearch {
        hosts => ["...:9200"]
        ilm_rollover_alias => "filebeat"
        ilm_pattern => "000001"
        ilm_policy => "filebeat-ilm-policy"
        document_type => "log"
        user => "elastic"
        password => "${ELASTIC_PASSWORD}"
        manage_template => false
        action => "create"

Well, I've fixed it. I'm not sure what I did, but the addition of the previously missing template.settings.index.lifecycle.name from the index template might have been what made the difference.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.