# Logstash cannot index to Elasticsearch
**URL:** https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708
**Category:** Logstash
**Created:** [April 19, 2018, 1:22pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708 "2018-04-19T13:22:44Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@haseebsabir](https://discuss.elastic.co/u/haseebsabir)
#### Post date: [April 19, 2018, 1:22pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/1 "2018-04-19T13:22:44Z")
I am very new to ELK. I am getting error message that logstash Could not index event to Elasticsearch.
[2018-04-18T16:30:06,128][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2018.04.18", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x19f861b6], :response=\>{"index"=\>{"\_index"=\>"logstash-2018.04.18", "\_type"=\>"doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Failed to parse mapping [_default_]: [include\_in\_all] is not allowed for indices created on or after version 6.0.0 as [\_all] is deprecated. As a replacement, you can use an [copy\_to] on mapping fields to create your own catch all field.", "caused\_by"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"[include\_in\_all] is not allowed for indices created on or after version 6.0.0 as [\_all] is deprecated. As a replacement, you can use an [copy\_to] on mapping fields to create your own catch all field."}}}}}
Can someone help to resolve this issue.
---
### Author:  [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)
#### Post date: [April 19, 2018, 1:54pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/2 "2018-04-19T13:54:30Z")
Hi,
The resolution begins first by understanding the reason for the `WARN` logging.
In particular `"reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}`
You may need to review your mapping with this in mind: [https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html)
---
### Author:  [@haseebsabir](https://discuss.elastic.co/u/haseebsabir)
#### Post date: [April 19, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/3 "2018-04-19T13:59:38Z")
I am new to logstash. Can you guide me how to review mapping.
Thanks in advance.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 19, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/4 "2018-04-19T14:12:23Z")
I guess you are using a wrong template. Did you specify a template one in your pipeline configuration in the logstash ElasticSearch output?
If not, you could execute `GET /_cat/templates` in the console in Kibana to list all templates in ES and `GET /_template/` to have a look at one.
If you did not create any index template in ElasticSearch, it's probably using a default logstash one and you can look for it in your logstash installation directory at `/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.3-java/lib/logstash/outputs/elasticsearch`. (I don't have any experience with those)
---
### Author:  [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)
#### Post date: [April 19, 2018, 2:26pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/5 "2018-04-19T14:26:06Z")
@haseebsabir
What version of logstash are you using?
In Elasticsearch 6.0 the \_all field is disabled/deprecated as outlined in the docs about breaking mapping changes: [https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking\_60\_mappings\_changes.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking_60_mappings_changes.html)
It seems you are using include\_in\_all in your mapping template, which is causing this.
@Jenni =\> [https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es6x.json](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es6x.json)
---
### Author:  [@haseebsabir](https://discuss.elastic.co/u/haseebsabir)
#### Post date: [April 19, 2018, 2:52pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/6 "2018-04-19T14:52:42Z")
I am using logstash 6.2.3 but when i ran Get /\_template/logstash it shows "version": 50001.
"logstash": {
"order": 0,
"version": 50001,
"index\_patterns": [
"logstash-\*"
],
"settings": {
"index": {
"refresh\_interval": "5s"
}
},
"mappings": {
"_default_": {
"\_all": {
"enabled": true,
"norms": false
},
I had logstash 5 previously installed. I removed it using "rpm -e logstash" command. It seems it is trying to use data created by previous version.
This is config of output section currently running on logstash 6.2.3.
output {
elasticsearch {
hosts =\> "localhost:9200"
index =\> "logstash-%{+YYYY.MM.dd}"
}
How i can remove config of older version.
---
### Author:  [@haseebsabir](https://discuss.elastic.co/u/haseebsabir)
#### Post date: [April 19, 2018, 4:22pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/7 "2018-04-19T16:22:29Z")
issue resolved.
First list all templates as
GET /\_cat/templates
then delete all templates
delete /\_template/logstash
Restart ELK services
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2018, 4:22pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-to-elasticsearch/128708/8 "2018-05-17T16:22:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.