LOgstash 6.2 Template Mapping not able to write to index

HI
i am using 6.2 and i made changes to my template file as required but i am getting below error in logstash.

Blockquote
indent preformatted text by 4 spaces
[2018-03-13T06:55:55,748][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"foltsdb-2018.03.13", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x199f431e], :response=>{"index"=>{"_index"=>"foltsdb-2018.03.13", "_type"=>"doc", "_id"=>"KdWlH2IB9vIHqwZ6YyrH", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Could not convert [message.index] to boolean", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Failed to parse value [not_analyzed] as only [true] or [false] are allowed."}}}}}}
indent preformatted text by 4 spaces

indent preformatted text by 4 spaces

here my logstash template:
indent preformatted text by 4 spaces
{
"template" : "foltsdb-*",
"settings" : {
"index.refresh_interval" : "10s"
},
"mappings" : {
"_doc": {

   "dynamic_templates" : [
      {
        "message_field" : {
          "path_match" : "message",
          "mapping" : {
           "type" : "keyword", "omit_norms" : true
       },
          "match_mapping_type" : "string"
        }
      },
      
	  {
	    "integers": {
        "match_mapping_type": "long",
        "mapping": {
          "type": "integer"
        }
      }
    },
	  
	  {
        "string_fields" : {
          "mapping" : {
            "type" : "text", "index" : "analyzed", "norms": false,
            "fields" : {
              "keyword" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 1024}
            }
          },
          "match_mapping_type" : "string",
          "match" : "*"
        }
      }
    ],
  
   
   "properties" : {

"@timestamp" : { "format" : "dateOptionalTime","type" : "date" },
"@version":{ "type": "keyword" },
"host": { "type": "keyword" },
"path": { "type": "keyword" },
"Application": { "type": "keyword" },
"TransactionName": { "type": "keyword" },
"StartTime": { "type": "date", "format" : "dateOptionalTime" },
"Status": { "type": "text" },
"ResponseCode": { "type": "keyword" },
"ResponseTime": { "type": "integer" },
"Latency": { "type": "integer" },
"Throughput": { "type": "integer" },
"TestId": { "type": "keyword" }

   }
}

}
}
indent preformatted text by 4 spaces

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.