I have struggled with this for a few days now trying all the documentation and this forum without much luck...
I'm using Elastic Stack for a classic centralised logging use case. ES 5.2.2. Logstash is creating daily indices.
I have logs coming from many sources and I can't really control the format of each field so I'm running into field data type conflicts which by Elasticsearch defaults is handled by rejecting the whole document.
I have tried to use the the PUT mapping API to set "ignore_malformed": true for the fields that are causing issues but I keep getting unsupported parameters ignore_malformed errors.
What I can do is set index.mapping.ignore_malformed for new indices. That would be fine but I don't really want to do that manually for every index.
Question: Is there a way to set index.mapping.ignore_malformed as a default for all new indices?
Any answers and/or comments are appreciated