#! Deprecation: Deprecated field [template] used, replaced by [index_patterns]

Elastic Stack Elasticsearch
1

iam trying to create a new index but this error occurs

2

Share what you are doing. The exact commands, version...

3

I'm facing similar problem and looking for help. Steps to reproduce:

  • Environment: new created GCP compute engine, Debian 9, only Docker installed
  • Version: Filebeat, Elasticsearch, Kibana, all 6.2.4, Docker image
$ docker network create ebk

$ sudo sysctl -w vm.max_map_count=262144

$ docker run -d --network=ebk --name es1 -p 9200:9200 -p 9300:9300 -e ELASTIC_PASSWORD=<password> -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" -v path/to/data:/usr/share/elasticsearch/data docker.elastic.co/elasticsearch/elasticsearch:6.2.4

$ docker run -d --network=ebk --name kibana -p 5601:5601 -v path/to/kibana.yml:/usr/share/kibana/config/kibana.yml docker.elastic.co/kibana/kibana:6.2.4

$ touch filebeat.yml

Content of filebeat.yml:

filebeat.prospectors:
- type: log
  enabled: true
  paths: /var/log/*.log

output.elasticsearch:
  hosts: ["es1:9200"]
  username: elastic
  password: <password>

setup.dashboards:
  enabled: true

setup.kibana:
  host: "kibana:5601"

Everything goes well so far. Then I start filebeat:

$ docker run -d --network=ebk --name fbeat -v path/to/filebeat.yml:/usr/share/filebeat/filebeat.yml -v path/to/log:/var/log --hostname <hostname> docker.elastic.co/beats/filebeat:6.2.4

Each time I start fbeat container, elasticsearch generates 2X lines of same log:

[2018-04-30T08:52:40,438][WARN ][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index_patterns]
4

After version 5.6 the format of Elasticsearch index templates changed; the template field, which was used to specify one or more patterns for matching index names that would use the template at create time, was deprecated and superseded by the more appropriately named field index_patterns which works exactly the same way.

To solve the issue and get rid of the deprecation warnings you will have to update all your pre-6.0 index templates, changing the template to index_patterns.

You can list all your index templates by running this command:

curl -XGET 'http://localhost:9200/_template/*?pretty'

Or replace the asterisk with the name of one specific index template.

1 Like
5

thanks,it worked for me.

6

@Hunsin You mount a data directory. Could it be that this contains old Elasticsearch data or is it a fresh empty directory? Could you share your full Filebeat and Elasticsearch log?

I tried to reproduce a simplified version by just starting and 6.2.4 elasticsearch container and point 6.2.4 Filebeat at it but without success.

7

@ruflin it's an empty directory.
If I remove setup.dashboards.enabled: true from the filebeat.yml, then no more log generated from ES.
Is it a bad configuration or something related to Kibana?

8

@Hunsin This was the key. I managed to reproduce this. It seems that somehow when running with --setup the Kibana API does something that triggers this. I will check further internally where this is coming from. Probably an API in Kibana that is not update yet.

Thanks for being consistent and pushing this forward.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.