Events not indexed although dynamic set to false (and not strict)

Elastic Stack Elasticsearch
1

I had initially set my dynamic field of my template to strict.
For some reason (perhaps some events out of the ones defined in the template got away) all events got 400, so I decided to change my dynamic field to false.

  "mappings": {
    "_doc": {
      "dynamic": "false",
      "properties": {
        "_time": {"type":"date"},
...

However, although I deleted the daily index, I get the rejections again:

[2019-02-14T09:23:23,484][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"epaloalto_raw_data-2019.02.14", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x1e5d6507>], :response=>{"index"=>{"_index"=>"paloalto_raw_data-2019.02.14", "_type"=>"_doc", "_id"=>"537j6mgBNHkpa2Kwe8fX", "status"=>400, "error"=>{"type"=>"strict_dynamic_mapping_exception", "reason"=>"mapping set to strict, dynamic introduction of [type] within [_doc] is not allowed"}}}}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.