Hi there,
I'm currently running an ELK stack with version 6.8.4 in a single node setup and preparing it for migration to 7.4.x.
My data is stored through filebeat -> logstash -> elasticsearch where logstash also does the template handling. My output section looks like this:
elasticsearch {
hosts => "elasticsearch:9200"
user => "${LOGSTASH_USER}"
password => "${LOGSTASH_PASSWORD}"
index => "mydata-%{[@metadata][index_day]}"
manage_template => "true"
template_name => "mydata-template"
template => "/usr/share/logstash/templates/elasticsearch-7x-template-mydata.json"
template_overwrite => true
document_id => "%{[@metadata][fingerprint]}"
}
I'm currently checking all the WARNings in the logs of both elasticseach and logstash and found include_type_name
warnings like this:
[2019-11-12T10:52:19,789][WARN ][o.e.d.r.a.a.i.RestGetIndexTemplateAction] [Jnsuswi] [types removal] The parameter include_type_name should be explicitly specified in get template requests to prepare for 7.0. In 7.0 include_type_name will default to 'false', which means responses will omit the type name in mapping definitions.
[2019-11-12T10:52:20,100][WARN ][o.e.d.r.a.a.i.RestPutIndexTemplateAction] [Jnsuswi] [types removal] The parameter include_type_name should be explicitly specified in put template requests to prepare for 7.0. In 7.0 include_type_name will default to 'false', and requests are expected to omit the type name in mapping definitions.
This WARNings are raised when I restart logstash and it tries to fetch/update the template.
Is there a way I can fix this warnings when going the logstash way? From checking the docs it looks like the parameter is a query parameter and in the docs for logstash elasticsearch output don't say a single word about include_type_name
)