Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters

Elastic Stack Beats
1

I have just upgraded filebeat from 5.6.4 to 6.0.0 and logs are being flooded with:

2017/11/30 16:24:23.327596 client.go:465: WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}

and there is no logs were sent to Elasticsearch.

Config file:

filebeat.prospectors:
- type: log
  paths:
   - '/var/lib/docker/containers/*/*.log'
  json.message_key: log
  json.keys_under_root: true
  processors:
  - add_docker_metadata: ~
output.elasticsearch:
  ...

Elasticsearch version: 6.0.0

2

You have any field named error in your JSON document?

3

This fixed my problem: Filebeat v6 and elasticsearch v6

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.