Index/Template Question After Upgrade (Single Type)

Elastic Stack Elasticsearch
1

OK, so I see that new ELK doesn't have multiple mapping types. Had tons of errors, and believed I fixed it by removing the additional types being added at my logstash level. However, although all my data appears to be coming through I keep getting a mapping error every so many seconds about two types trying to be mapped. Is it possibly in my index? If someone with a little more experience could help me decipher what I believe is the index template used to create my daily index and let me know, I'd appreciate it!

Here is the error code:

If the embed code doesn't work (https://gist.github.com/anonymous/12bf3ec27d5971c32c9741313af34642)

Here is the index I believe used:

If the embed doesn't work
( https://gist.github.com/anonymous/4706d8495c07d39eea2759d339cac1e1 ).

First time using Gist, sorry if it doesn't look right.

Thanks anyone for looking!

2

it's very hard to tell where the extra type is coming from. do you still have an old logstash running somewhere?

3

I appreciate your response. When you said that, that got me thinking about checking all the servers to see if maybe any of them were pointing to a logstash server maybe I didn't know about(I didn't set up the system, and assumed any logstash node would show up in the cluster info, but you never know).

Well, lo and behold that investigating paid off and I found 9 or 10 servers with filebeat installed on them that were bypassing a logstash server and sending the data straight to the elasticsearch node. I didn't even think that was possible! But, after I fixed those, the errors have now gone away.

Although maybe you didn't point out the solution directly, you did help me get to the bottom of this by getting me on the right path, so thank you!!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.