Hi everyone,
I wanna ask about help with sending logs to Elasticsearch.
I use kv filter to parse logs from Fortigate devices.
One of logged fields is named type which is automaticaly parsed to meta field _type.
Since Elasticsearch removed support multiple types in new indexes I can't log from Fortigate.
I get an error:
Rejecting mapping update to [fg-2017.11.23] as the final mapping would have more than 1 type: [utm, traffic]
I tried to modify _type filed in logstash before sending to Elasticseach like below but no luck.
input {
udp {
port => 3341
add_field => { "log_source" => "fortigate" }
}
}
filter {
if [log_source] == "fortigate" {
kv {}
mutate { copy => { "index_type" => "logtype" } }
mutate { remove_field => [ "index_type" ] }
}
}
output {
if [log_source] == "fortigate" {
elasticsearch {
hosts => [ "localhost:9200" ]
index => 'fg-%{+YYYY.MM.dd}'
}
}
}
How to fix this problem?