# \[include\_in\_all\] is not allowed for indices (after upgrading to 6.0.0)

**URL:** https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769
**Category:** Logstash
**Created:** [November 30, 2017, 2:19pm UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769 "2017-11-30T14:19:39Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![dulman](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@dulman](https://discuss.elastic.co/u/dulman)
#### Post date: [November 30, 2017, 2:19pm UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769/1 "2017-11-30T14:19:39Z")

</div>

Hello,

we have upgraded our Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) to version 6.0.0.

Our Logstash config:

```
input {
tcp {
   type => app
   port => 5140
 }
}

output {
	elasticsearch {
            hosts=> ["elasticsearch-endpoint"]
            index=> "logstash-dev-elastic01-app-%{+YYYY.MM.dd}"
    }
} 

```

With this config we are running into mapper\_parsing\_exceptions:

`[2017-11-30T14:06:14,283][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-dev-elastic01-app-2017.11.30", :_type=>"app", :_routing=>nil}, #<LogStash::Event:0x16db134e @data={"@timestamp"=>2017-11-30T14:06:14.267Z, "port"=>23639, "@version"=>"1", "host"=>"ip-00-00-00-00.eu-central-1.compute.internal", "@metdata"=>{"ip_address"=>"00.00.00.00"}, "message"=>"{\"hostname\":\"app1\",\"env\":\"him1\",\"level\":\"info\",\"message\":\"executing job close-incidents-job\",\"label\":\"cron\"}", "type"=>"app"}>], :response=>{"index"=>{"_index"=>"logstash-dev-elastic01-app-2017.11.30", "_type"=>"app", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}`

How to solve this problem?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2017, 6:30am UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769/2 "2017-12-04T06:30:11Z")

</div>

It seems like the index template being applied is too old for your ES instance. What does your index template look like?

---

<div class="post-metadata">

### Author: ![dulman](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@dulman](https://discuss.elastic.co/u/dulman)
#### Post date: [December 4, 2017, 12:13pm UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769/3 "2017-12-04T12:13:03Z")

</div>

Ok, I had to delete the logstash template manually.

> curl -XDELETE '[http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash)'

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2018, 12:13pm UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769/4 "2018-01-01T12:13:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.