I am very new to ELK. I am getting error message that logstash Could not index event to Elasticsearch.
[2018-04-18T16:30:06,128][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.04.18", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x19f861b6], :response=>{"index"=>{"_index"=>"logstash-2018.04.18", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [default]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
Hi,
The resolution begins first by understanding the reason for the WARN logging.
In particular "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
I guess you are using a wrong template. Did you specify a template one in your pipeline configuration in the logstash ElasticSearch output?
If not, you could execute GET /_cat/templates in the console in Kibana to list all templates in ES and GET /_template/<template name> to have a look at one.
If you did not create any index template in ElasticSearch, it's probably using a default logstash one and you can look for it in your logstash installation directory at /vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch. (I don't have any experience with those)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.