#! Deprecation: Deprecated field [template] used, replaced by [index_patterns]

(Yaasar Shaikh) #1

iam trying to create a new index but this error occurs

(David Pilato) #2

Share what you are doing. The exact commands, version...

(Tsai, Hsiao Chieh) #3

I'm facing similar problem and looking for help. Steps to reproduce:

  • Environment: new created GCP compute engine, Debian 9, only Docker installed
  • Version: Filebeat, Elasticsearch, Kibana, all 6.2.4, Docker image
$ docker network create ebk

$ sudo sysctl -w vm.max_map_count=262144

$ docker run -d --network=ebk --name es1 -p 9200:9200 -p 9300:9300 -e ELASTIC_PASSWORD=<password> -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" -v path/to/data:/usr/share/elasticsearch/data docker.elastic.co/elasticsearch/elasticsearch:6.2.4

$ docker run -d --network=ebk --name kibana -p 5601:5601 -v path/to/kibana.yml:/usr/share/kibana/config/kibana.yml docker.elastic.co/kibana/kibana:6.2.4

$ touch filebeat.yml

Content of filebeat.yml:

- type: log
  enabled: true
  paths: /var/log/*.log

  hosts: ["es1:9200"]
  username: elastic
  password: <password>

  enabled: true

  host: "kibana:5601"

Everything goes well so far. Then I start filebeat:

$ docker run -d --network=ebk --name fbeat -v path/to/filebeat.yml:/usr/share/filebeat/filebeat.yml -v path/to/log:/var/log --hostname <hostname> docker.elastic.co/beats/filebeat:6.2.4

Each time I start fbeat container, elasticsearch generates 2X lines of same log:

[2018-04-30T08:52:40,438][WARN ][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index_patterns]

(Bernt Rostad) #4

After version 5.6 the format of Elasticsearch index templates changed; the template field, which was used to specify one or more patterns for matching index names that would use the template at create time, was deprecated and superseded by the more appropriately named field index_patterns which works exactly the same way.

To solve the issue and get rid of the deprecation warnings you will have to update all your pre-6.0 index templates, changing the template to index_patterns.

You can list all your index templates by running this command:

curl -XGET 'http://localhost:9200/_template/*?pretty'

Or replace the asterisk with the name of one specific index template.

(Yaasar Shaikh) #5

thanks,it worked for me.

(ruflin) #6

@Hunsin You mount a data directory. Could it be that this contains old Elasticsearch data or is it a fresh empty directory? Could you share your full Filebeat and Elasticsearch log?

I tried to reproduce a simplified version by just starting and 6.2.4 elasticsearch container and point 6.2.4 Filebeat at it but without success.

(Tsai, Hsiao Chieh) #7

@ruflin it's an empty directory.
If I remove setup.dashboards.enabled: true from the filebeat.yml, then no more log generated from ES.
Is it a bad configuration or something related to Kibana?

(ruflin) #8

@Hunsin This was the key. I managed to reproduce this. It seems that somehow when running with --setup the Kibana API does something that triggers this. I will check further internally where this is coming from. Probably an API in Kibana that is not update yet.

Thanks for being consistent and pushing this forward.

(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.