Final mapping would have more than 1 type: [_doc, doc]

Elastic Stack Logstash
1

I am getting below error in my logstash logs:

[2019-06-06T01:06:27,503][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-2019.05.24", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x4e319ffe], :response=>{"index"=>{"_index"=>"winlogbeat-2019.05.24", "_type"=>"doc", "_id"=>"tS8uK2sBel10KW7wWKLs", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [winlogbeat-2019.05.24] as the final mapping would have more than 1 type: [_doc, doc]"}}}}
[2019-06-06T01:06:27,504][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-2019.05.24", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x3cad446], :response=>{"index"=>{"_index"=>"winlogbeat-2019.05.24", "_type"=>"doc", "_id"=>"ti8uK2sBel10KW7wWKLs", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [winlogbeat-2019.05.24] as the final mapping would have more than 1 type: [_doc, doc]"}}}}

Below is the output configuration file content:

output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"

   }

stdout {
codec => rubydebug
}
}

2

document_type is being retired. See here.

3

Can you please help me in replacing the code ? Exactly, what should I replace document_type with and how ?

4

Just do not use that option.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.