Logstash 6.8 template gives 400 HTTP response code

Elastic Stack Logstash
1

Hello, I'm in the middle of process of migrating ELK Stack from 5.4 to 7.1. I'm currently on 6.8 and my Logstash gives me HTTP response code 400 after start when I'm trying to import my template. I've renamed string values and deleted _all references. Could you tell me what I need to change in the below template to get it working

 {
  "template" : "*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "number_of_replicas" : 0
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "match" : "message",
          "match_mapping_type" : "text",
          "mapping" : {
            "type" : "text", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" }
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "text",
          "mapping" : {
            "type" : "text", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" },
            "fields" : {
              "raw" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 256}
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date" },
        "@version": { "type": "keyword", "index": "not_analyzed" },
        "geoip"  : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "float" },
            "longitude" : { "type" : "float" }
          }
        }
      }
    }
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.