Hi Krunal,
I had to make some changes to install it in 6.2 and installed it in ES using Kibana console -
PUT _template/weblog.template
{
"index_patterns": ["weblog*"],
"settings": {
"number_of_shards": 1,
"index.refresh_interval": "5s"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"omit_norms": false
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"omit_norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
},
"location": {
"type": "geo_point"
}
}
}
}
}
Modified o/p of logstash config to make use of this template -
output {
elasticsearch {
action => "index"
hosts => "localhost:9200"
index => "weblog-%{+YYYY.MM}"
template_name => "weblog.template"
}
stdout {
codec => rubydebug
}
}
Now hitting following error -
[2018-02-12T18:23:04,534][INFO ][logstash.pipeline ] Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x76158012 sleep>"}
[2018-02-12T18:23:04,561][INFO ][logstash.agent ] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-02-12T18:23:06,113][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"weblog-2018.02", :_type=>"doc", :_routi
ng=>nil}, #<LogStash::Event:0x770eb729>], :response=>{"index"=>{"_index"=>"weblog-2018.02", "_type"=>"doc", "_id"=>"1R5UjGEBVbzVFun6OmAG", "status"=>400, "error"=>{"type"=>"illegal_argument_exception"
, "reason"=>"[geoip.location] is defined as an object in mapping [doc] but this name is already used for a field in other types"}}}}
[2018-02-12T18:23:06,115][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"weblog-2018.02", :_type=>"doc", :_routi
ng=>nil}, #<LogStash::Event:0x74961af6>], :response=>{"index"=>{"_index"=>"weblog-2018.02", "_type"=>"doc", "_id"=>"4R5UjGEBVbzVFun6OmAH", "status"=>400, "error"=>{"type"=>"illegal_argument_exception"
, "reason"=>"[geoip.location] is defined as an object in mapping [doc] but this name is already used for a field in other types"}}}}
[2018-02-12T18:23:06,114][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"weblog-2018.02", :_type=>"doc", :_routi
ng=>nil}, #<LogStash::Event:0x3def49fe>], :response=>{"index"=>{"_index"=>"weblog-2018.02", "_type"=>"doc", "_id"=>"yR5UjGEBVbzVFun6OmAF", "status"=>400, "error"=>{"type"=>"illegal_argument_exception"
, "reason"=>"[geoip.location] is defined as an object in mapping [doc] but this name is already used for a field in other types"}}}}
This used to work perfectly on ELK stack 5.3.0 for. Not sure what's wrong here and stuck on this. Any help is really appreciated.
Thank you!
