_data_stream_timestamp conflicts?

Elastic Stack Elasticsearch
1

Does anyone know what this means please? I get this on every attempt Logstash makes to index an event.

"status"=>400,
"error"=>{"type"=>"illegal_argument_exception",
"reason"=>"Mapper for [_data_stream_timestamp] conflicts with existing mapper:\n\tCannot update parameter [enabled] from [true] to [false]"

This my first attempt to use a "data stream". I don't know what _data_stream_timestamp is, I haven't set it to anything, and I can't find any documentation on it.

The Logstash output configuration is

    output {
      elasticsearch {
        hosts => ["...:9200"]
        ilm_rollover_alias => "filebeat"
        ilm_pattern => "000001"
        ilm_policy => "filebeat-ilm-policy"
        document_type => "log"
        user => "elastic"
        password => "${ELASTIC_PASSWORD}"
        manage_template => false
        action => "create"
      }
    }
2

Well, I've fixed it. I'm not sure what I did, but the addition of the previously missing template.settings.index.lifecycle.name from the index template might have been what made the difference.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.