I am running ELK 6.5.4 and trying to use the http_poller to poll data into ELK but my logstash is unable to index to Elasticsearch and throws error message ]logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"%{[id]}", :_index=>"index-2019.02.11", :_type=>"bikestatus", :routing=>nil}, #LogStash::Event:0x1ac6e8e1], :response=>{"index"=>{"_index"=>"bikestatus-dc-2019.02.11", "_type"=>"bikestatus", "_id"=>"%{[id]}", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Could not convert [location.index] to boolean", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Failed to parse value [not_analyzed] as only [true] or [false] are allowed."}}}}}}. I posted this in Logstash forum but it seems to be an issue with Elasticsearch. Here's the link to my post in Logstash forum https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch-for-http-poller/167931/5?u=imortalsolitude
I think this could be the error the template is not being used
elasticsearch - Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://10.1.0.187:9200/_template/bikesstatus'", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in
perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:278:in block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in
with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:277:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in
block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:352:in template_put'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in
template_install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:22:in install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:10:in
install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/common.rb:130:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.3.0-java/lib/logstash/outputs/elasticsearch/common.rb:51:in
block in setup_after_successful_connection'"]}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.