# Logstash 6.8 template gives 400 HTTP response code

**URL:** <https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699>\
**Category:** Logstash\
**Created:** [December 27, 2020, 11:04pm UTC](https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699 "2020-12-27T23:04:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mlpn](https://avatars.discourse-cdn.com/v4/letter/m/258eb7/32.png) [@mlpn](https://discuss.elastic.co/u/mlpn)\
**Post date:** [December 27, 2020, 11:04pm UTC](https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699/1 "2020-12-27T23:04:36Z")

</div>

Hello, I'm in the middle of process of migrating ELK Stack from 5.4 to 7.1. I'm currently on 6.8 and my Logstash gives me HTTP response code 400 after start when I'm trying to import my template. I've renamed string values and deleted \_all references. Could you tell me what I need to change in the below template to get it working

```auto
 {
  "template" : "*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "number_of_replicas" : 0
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "match" : "message",
          "match_mapping_type" : "text",
          "mapping" : {
            "type" : "text", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" }
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "text",
          "mapping" : {
            "type" : "text", "index" : "analyzed", "omit_norms" : true,
            "fielddata" : { "format" : "disabled" },
            "fields" : {
              "raw" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 256}
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date" },
        "@version": { "type": "keyword", "index": "not_analyzed" },
        "geoip" : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "float" },
            "longitude" : { "type" : "float" }
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2021, 11:04pm UTC](https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699/2 "2021-01-24T23:04:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.