I am trying to onboard datastream into my es cluster. I have created the ilm with necessary phases, created the index template and then creating the datastream. But I am stuck at one point and not able to go forward.
I have created the index template as below
curl -X PUT "localhost:9200/_index_template/my-datastream-template?pretty" -H 'Content-Type: application/json' -d'
{
"index_patterns": [
"*",
"-.*"
],
"priority": 500,
"data_stream": {},
"_meta": { "whatever": "you-want" },
"template": {
"settings": {
"index": {
"unassigned.node_left.delayed_timeout": "20m",
"search.idle.after": "20s",
"lifecycle": {
"name": "my-datastream-ilm"
},
"indexing": {
"slowlog": {
"threshold": {
"index": {
"warn": "5s",
"info": "2s",
"debug": "800ms",
"trace": "300ms"
}
}
}
},
"search": {
"slowlog": {
"threshold": {
"query": {
"warn": "10s",
"info": "5s",
"debug": "2s",
"trace": "500ms"
},
"fetch": {
"warn": "10s",
"info": "5s",
"debug": "2s",
"trace": "500ms"
}
}
}
},
"refresh_interval": "30s",
"codec": "best_compression",
"analysis": {
"analyzer": {
"case_insensitive_keyword_analyzer": {
"tokenizer": "keyword",
"filter": "lowercase"
}
}
}
}
},
"mappings": {
"properties": {
"@timestamp": {
"type": "date",
"format": "date_optional_time||epoch_millis"
},
"client": {
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"index_options": "docs",
"norms": false,
"fields": {
"raw": {
"type": "keyword"
}
}
},
"action": {
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"index_options": "docs",
"norms": false,
"fields": {
"raw": {
"type": "keyword"
}
}
},
"serverTime": {
"type": "date",
"index": false
},
"userTime": {
"type": "date",
"index": false
},
"ingestionTime": {
"type": "date",
"index": false
},
"campaignId": {
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"index_options": "docs",
"norms": false,
"fields": {
"raw": {
"type": "keyword"
}
},
"index": false
},
"primaryName": {
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"index_options": "docs",
"norms": false,
"fields": {
"raw": {
"type": "keyword"
}
},
"index": false
}
},
"dynamic_templates": [
{
"default_string_mapping": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"index": false,
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"norms": false,
"index_options": "docs",
"fields": {
"raw": {
"type": "keyword"
}
}
}
}
},
{
"geopoint_mapping": {
"match": "geopoint_*",
"mapping": {
"type": "geo_point",
"index": false
}
}
},
{
"string_mapping": {
"match": "string_*",
"mapping": {
"type": "text",
"analyzer": "case_insensitive_keyword_analyzer",
"norms": false,
"index_options": "docs",
"fields": {
"raw": {
"type": "keyword"
}
},
"index": false
}
}
},
{
"bool_mapping": {
"match": "bool_*",
"mapping": {
"type": "boolean",
"index": false
}
}
},
{
"datetime_mapping": {
"match": "datetime_*",
"mapping": {
"type": "date",
"index": false
}
}
},
{
"long_mapping": {
"match": "long_*",
"mapping": {
"type": "long",
"index": false
}
}
},
{
"double_mapping": {
"match": "double_*",
"mapping": {
"type": "double",
"index": false
}
}
},
{
"object_mapping": {
"match": "object_*",
"mapping": {
"type": "nested",
"index": false
}
}
}
]
}
}
}
'
After this, when I try to create the data stream index I get the below error.
{
"error" : {
"root_cause" : [
{
"type" : "illegal_state_exception",
"reason" : "[_data_stream_timestamp] meta field has been disabled"
}
],
"type" : "illegal_state_exception",
"reason" : "[_data_stream_timestamp] meta field has been disabled"
},
"status" : 500
}
Where am I going wrong here?