Datastream index template not working

Elastic Stack Elasticsearch
1

I am trying to onboard datastream into my es cluster. I have created the ilm with necessary phases, created the index template and then creating the datastream. But I am stuck at one point and not able to go forward.

I have created the index template as below

curl -X PUT "localhost:9200/_index_template/my-datastream-template?pretty" -H 'Content-Type: application/json' -d'
{
  "index_patterns": [
    "*",
    "-.*"
  ],
  "priority": 500,
  "data_stream": {},
  "_meta": { "whatever": "you-want" },
  "template": {
    "settings": {
      "index": {
        "unassigned.node_left.delayed_timeout": "20m",
        "search.idle.after": "20s",
        "lifecycle": {
          "name": "my-datastream-ilm"
        },
        "indexing": {
          "slowlog": {
            "threshold": {
              "index": {
                "warn": "5s",
                "info": "2s",
                "debug": "800ms",
                "trace": "300ms"
              }
            }
          }
        },
        "search": {
          "slowlog": {
            "threshold": {
              "query": {
                "warn": "10s",
                "info": "5s",
                "debug": "2s",
                "trace": "500ms"
              },
              "fetch": {
                "warn": "10s",
                "info": "5s",
                "debug": "2s",
                "trace": "500ms"
              }
            }
          }
        },
        "refresh_interval": "30s",
        "codec": "best_compression",
        "analysis": {
          "analyzer": {
            "case_insensitive_keyword_analyzer": {
              "tokenizer": "keyword",
              "filter": "lowercase"
            }
          }
        }
      }
    },
    "mappings": {
      "properties": {
        "@timestamp": {
            "type": "date",
            "format": "date_optional_time||epoch_millis"
        },
        "client": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          }
        },
        "action": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          }
        },
        "serverTime": {
          "type": "date",
          "index": false
        },
        "userTime": {
          "type": "date",
          "index": false
        },
        "ingestionTime": {
          "type": "date",
          "index": false
        },
        "campaignId": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          },
          "index": false
        },
        "primaryName": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          },
          "index": false
        }
      },
      "dynamic_templates": [
        {
          "default_string_mapping": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "index": false,
              "type": "text",
              "analyzer": "case_insensitive_keyword_analyzer",
              "norms": false,
              "index_options": "docs",
              "fields": {
                "raw": {
                  "type": "keyword"
                }
              }
            }
          }
        },
        {
          "geopoint_mapping": {
            "match": "geopoint_*",
            "mapping": {
              "type": "geo_point",
              "index": false
            }
          }
        },
        {
          "string_mapping": {
            "match": "string_*",
            "mapping": {
              "type": "text",
              "analyzer": "case_insensitive_keyword_analyzer",
              "norms": false,
              "index_options": "docs",
              "fields": {
                "raw": {
                  "type": "keyword"
                }
              },
              "index": false
            }
          }
        },
        {
          "bool_mapping": {
            "match": "bool_*",
            "mapping": {
              "type": "boolean",
              "index": false
            }
          }
        },
        {
          "datetime_mapping": {
            "match": "datetime_*",
            "mapping": {
              "type": "date",
              "index": false
            }
          }
        },
        {
          "long_mapping": {
            "match": "long_*",
            "mapping": {
              "type": "long",
              "index": false
            }
          }
        },
        {
          "double_mapping": {
            "match": "double_*",
            "mapping": {
              "type": "double",
              "index": false
            }
          }
        },
        {
          "object_mapping": {
            "match": "object_*",
            "mapping": {
              "type": "nested",
              "index": false
            }
          }
        }
      ]
    }
  }
}
'

After this, when I try to create the data stream index I get the below error.

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_state_exception",
        "reason" : "[_data_stream_timestamp] meta field has been disabled"
      }
    ],
    "type" : "illegal_state_exception",
    "reason" : "[_data_stream_timestamp] meta field has been disabled"
  },
  "status" : 500
}

Where am I going wrong here?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.