Indexing with deprecated _type field

Elastic Stack Elasticsearch
16

I see.

Some comments. I can see from Metron – Elasticsearch in Metron that:

Project Metron has retired.

The last version, this project is supporting is 5.6 if I read that correctly.
Here you are trying to use it with a 7.x version. It might work with some luck but I'm almost sure it won't work anymore in the future as types are going away. See Removal of mapping types | Elasticsearch Guide [7.12] | Elastic

Your "template" API call is the new way to create index templates. It does not support the include_type_name option. So you would need to call the legacy template.

This will work:

DELETE logstash_index_test
DELETE _template/logstash
PUT _template/logstash?include_type_name=true
{
  "index_patterns": [
    "logstash_index_*"
  ],
  "mappings": {
    "logstash_doc": {
      "dynamic_templates": [
        {
          "timestamps_ts": {
            "mapping": {
              "format": "epoch_millis",
              "type": "date"
            },
            "match": "*ts",
            "match_mapping_type": "*"
          }
        },
        {
          "timestamps_milliseconds": {
            "mapping": {
              "format": "epoch_millis",
              "type": "date"
            },
            "match": "*_milliseconds",
            "match_mapping_type": "*"
          }
        },
        {
          "timestamps_seconds": {
            "mapping": {
              "format": "epoch_second",
              "type": "date"
            },
            "match": "*_seconds",
            "match_mapping_type": "*"
          }
        }
      ],
      "properties": {
        "source": {
          "properties": {
            "ip": {
              "type": "ip"
            },
            "port": {
              "type": "long"
            }
          }
        },
        "timestamp": {
          "type": "long"
        }
      }
    }
  },
  "settings": {
    "index": {
      "refresh_interval": "15s",
      "number_of_shards": "1"
    }
  }
}
POST _bulk 
{ "index": { "_index": "logstash_index_test", "_type": "logstash_doc" }}
{ "parallelenricher.splitter.end.ts": "1619587111219", "destination": { "port": 123,"ip": "100.100.100.100"}, "source": { "port": 123, "ip": "101.101.101.101"}, "message": "<132>Apr 27 2021 20:21:44: %ASA-4-106023: Deny udp src Ingress_Interface:100.100.100.100/123 dst Egress_Interface:101.101.101.101/123 by access-group \"Rule_Name\" [0x0, 0x0]\n", "parallelenricher.enrich.begin.ts": "1619587111219", "metron.metadata.topic": "asa_after_logstash", "source.type": "asa_logstash", "parallelenricher.splitter.begin.ts": "1619587111219", "observer": { "ingress": { "interface": { "name": "Ingress_Interface" } },"egress": {"interface": {"name": "Egress_Interface"}}},"@timestamp": "2021-04-28T05:18:02.726Z", "original_string": "{\"observer\":{\"ingress\":{\"interface\":{\"name\":\"Ingress_Interface\"}},\"egress\":{\"interface\":{\"name\":\"Egress_Interface\"}}},\"@timestamp\":\"2021-04-28T05:18:02.726Z\",\"organization\":{\"id\":\"0\"},\"destination\":{\"ip\":\"101.101.101.101\",\"port\":123},\"@version\":\"1\",\"source\":{\"ip\":\"100.100.100.100\",\"port\":123},\"message\":\"<132>Apr 27 2021 20:21:44: %ASA-4-106023: Deny udp src Ingress_Interface:100.100.100.100\\/123 dst Egress_Interface:101.101.101.101\\/123 by access-group \\\"Ingress_Interface_access_in_1\\\" [0x0, 0x0]\\n\",\"cisco\":{\"asa\":{\"Egress_Interface\":\"Ingress_Interface_access_in_1\",\"outcome\":\"Deny\",\"network\":{\"transport\":\"udp\"}}}}", "parallelenricher.enrich.end.ts": "1619587111219", "organization": { "id": "0"}, "@version": "1", "guid": "da35ff9a-195f-4e48-9a74-ff07ff9ff087", "cisco": { "asa": { "Egress_Interface": "Rule_Name", "outcome": "Deny", "network": { "transport": "udp"}}},"timestamp": 1619587083600}

But again, this is not going to work in the future.