Upgrading to 6.0.0 of the ELK stack
Can anyone please help me why i get this entrys over and over in the Logstash log
[2017-11-16T20:49:36,973][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"winlogbeat-2017.11.16", :_type=>"wineventlog", :_routing=>nil}, #LogStash::Event:0x59ffd445], :response=>{"index"=>{"_index"=>"winlogbeat-2017.11.16", "_type"=>"wineventlog", "_id"=>"LcRhxl8BA5Maqd7NKABD", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [winlogbeat-2017.11.16] as the final mapping would have more than 1 type: [doc, wineventlog]"}}}}
This is my logstash.json
input {
beats {
port => 5044
type => "log"
}
}filter {
if [task] == "Network Policy Server" {
mutate { add_tag => ["nps","radius"] }
}
}output {
if "radius" in [tags] {
elasticsearch {
hosts => "elasticsearchhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-radius-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
} else if "dc" in [tags] {
elasticsearch {
hosts => "elasticsearchhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-dc-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
} else {
elasticsearch {
hosts => "elasticsearchhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
}