# Events are not indexing after upgradtion 5.6 to 6.0
**URL:** https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337
**Category:** Elasticsearch
**Created:** [November 20, 2017, 8:45am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337 "2017-11-20T08:45:07Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 8:45am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/1 "2017-11-20T08:45:07Z")
Hello
I have upgraded elastic 5.6 to 6.0 and after that events are not indexing from any sources.
The below is a strip from logstash log. I have tried with and without index mapping.
Where can I find the updated index mapping templates?
[2017-11-20T11:37:44,696][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"winlogbeat-2017.11.20", :\_type=\>"wineventlog", :\_routing=\>nil}, #LogStash::Event:0x2f9e59e5], :response=\>{"index"=\>{"\_index"=\>"winlogbeat-2017.11.20", "\_type"=\>"wineventlog", "\_id"=\>"kAiT2F8B8FIdclYYevZJ", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Rejecting mapping update to [winlogbeat-2017.11.20] as the final mapping would have more than 1 type: [winlogbeat, wineventlog]"}}}}
Regards
Sumesh
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 10:23am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/2 "2017-11-20T10:23:34Z")
It seems like your template created a type named `winlogbeat` and logstash is using `wineventlog`.
You need to either remove the template and replace it with what is needed or update your logstash configuration to use `winlogbeat`.
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 10:29am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/3 "2017-11-20T10:29:27Z")
> [@dadoonet](#):
>
> and logstash is usin
What I did was , followed this post [Help please.. breaking changes? - #10 by Maekee](https://discuss.elastic.co/t/help-please-breaking-changes/108010/10)
and
Changed the logstash output to this:
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
I was not using any index templates for mapping, still I dont understand why it started working!!!
Regards
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 10:46am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/4 "2017-11-20T10:46:43Z")
What are the existing index templates?
What is your logstash configuration?
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 10:50am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/5 "2017-11-20T10:50:30Z")
I have only one index template that is for logstash-\*
```auto
{
"logstash": {
"order": 0,
"version": 60001,
"index_patterns": [
"logstash-*"
],
"settings": {
"index": {
"refresh_interval": "5s"
}
```
Logstash :
```auto
input {
beats {
port => 5044
}
}
output {
{
elasticsearch {
hosts => "http://localhost:9200"
manage_template => true
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 11:06am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/6 "2017-11-20T11:06:21Z")
Please format your code using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will make your post more readable.
Or use markdown style like:
````
```
CODE
```
````
I edited your post.
You index template is not complete I think. Could you share the full one please?
I think your logstash config is wrong. Could you share the real one please?
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 12:22pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/7 "2017-11-20T12:22:50Z")
Yes David am posting it here
```
input {
beats {
port => 5044
}
}
```
filter{} portion
```
if [type]=="wineventlog"
{
mutate { add_field => { "indexType" => "WINDOWS-LOGS" }
}
}
```
output{}
```
if [indexType]== "WINDOWS-LOGS"
{
elasticsearch {
hosts => "http://localhost:9200"
manage_template => true
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
```
Thanks
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 12:37pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/8 "2017-11-20T12:37:40Z")
Please format your code using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will make your post more readable.
Or use markdown style like:
````
```
CODE
```
````
I’m pretty sure this logstash config does not work.
Which means you’re not copy/pasting it.
What is the mapping for your index?
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 12:48pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/9 "2017-11-20T12:48:44Z")
Hi David, my logstash configuration is huge that's why I have copied only the relevant portion. The remaining events processing and added to the indexes.
I have not specified any mapping as it is a new installation. So it might be taking the default mapping?
Regards
Sumesh
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 1:22pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/10 "2017-11-20T13:22:58Z")
Can you share the current mapping for this index?
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 20, 2017, 1:26pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/11 "2017-11-20T13:26:19Z")
Sorry, how to get that?
Is it same as \_/template/\* ?
Regards
Sumesh
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 20, 2017, 2:02pm UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/12 "2017-11-20T14:02:16Z")
```auto
GET winlogbeat-2017.11.20/_mapping
```
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 21, 2017, 4:49am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/13 "2017-11-21T04:49:37Z")
Hello, thanks. Here is the mapping.
[https://pastebin.com/8kLy5JU3](https://pastebin.com/8kLy5JU3)
Thanks
Sumesh
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 21, 2017, 6:54am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/14 "2017-11-21T06:54:25Z")
This is the mapping for 21st not 20th.
Do you still have the issue today?
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 21, 2017, 6:56am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/15 "2017-11-21T06:56:25Z")
Hello David
I have deleted that by mistake, anyway it is working fine today. Many thanks.
Regards
Sumesh
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 22, 2017, 6:58am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/16 "2017-11-22T06:58:24Z")
Hi David
If I haven't put any default index templates, how will elasticsearch map the data to an index?
Regards
Sumesh
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 22, 2017, 7:11am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/17 "2017-11-22T07:11:13Z")
It will guess. Which is sometime (often?) bad.
In practice, I feel better to define a mapping by my self so I have a finer control.
But if you are using Logstash or Beats, index templates are provided OOTB.
---
### Author:  [@sumeshms](https://discuss.elastic.co/u/sumeshms)
#### Post date: [November 22, 2017, 7:15am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/18 "2017-11-22T07:15:54Z")
Thanks David
I understood.
I have multiple sensors such as beats, json file input, syslog, tcp, snmp etc.
Regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2017, 7:15am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337/19 "2017-12-20T07:15:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.