Events not indexed although dynamic set to false (and not strict)

(Pantelis Karamolegkos) #1

I had initially set my dynamic field of my template to strict.
For some reason (perhaps some events out of the ones defined in the template got away) all events got 400, so I decided to change my dynamic field to false.

  "mappings": {
    "_doc": {
      "dynamic": "false",
      "properties": {
        "_time": {"type":"date"},

However, although I deleted the daily index, I get the rejections again:

[2019-02-14T09:23:23,484][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"epaloalto_raw_data-2019.02.14", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x1e5d6507>], :response=>{"index"=>{"_index"=>"paloalto_raw_data-2019.02.14", "_type"=>"_doc", "_id"=>"537j6mgBNHkpa2Kwe8fX", "status"=>400, "error"=>{"type"=>"strict_dynamic_mapping_exception", "reason"=>"mapping set to strict, dynamic introduction of [type] within [_doc] is not allowed"}}}}