ES Cloud: How to fix [include_in_all] is not allowed for indices created on or after version 6.0.0

[suchitgupta]

Hi Team,

Yesterday we upgraded to ES Cloud 6.0.0. We are using docker image of Logstash 5.6.3 for pushing the logs to ES Cloud.

The upgrade is not going well for us as we are getting following exceptions in our logstash:

"reason"=>"Failed to parse mapping [default]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}

Is there a way, I can update my logstash.conf and fix this issue? or is any configuration in ES cloud that I can help me.

[Alex_Piggott]

Hi @suchitgupta

Please raise this via support: https://discuss.elastic.co/t/now-live-new-elastic-cloud-standard-support/84161.
This channel is dedicated to Elastic Cloud Enterprise, which is a different product.

(This looks like an Elasticsearch issue not in anyway EC specific, so you might get fastest/best responses by reposting this in the Elasticsearch Discuss forum?)

Thanks
Alex