Trying to use the journald plugin with logstash/elastic 6.4.2 and I'm getting:
[2018-10-05T14:14:17,662][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"journald-%{[@metadata][version]}-2018.10.03", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x9433215], :response=>{"index"=>{"_index"=>"journald-%{[@metadata][version]}-2018.10.03", "_type"=>"doc", "_id"=>"sotLRmYBZ4A3W5U1sF6g", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field [_uid] is a metadata field and cannot be added inside a document. Use the index API request parameters."}}}}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.