Logstash Could not index event to Elasticsearch The [default] mapping cannot be updated on index


(Moshe Nadler) #1

After an upgrade to elastic stack 7 Logstash cannot send logs to elasticsearch any more. We see the following error:

[2019-04-17T14:25:31,292][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-aws-alb-logs-2019.04.17", :_type=>"_doc", :routing=>nil}, #LogStash::Event:0x47817ce4], :response=>{"index"=>{"_index"=>"logstash-aws-alb-logs-2019.04.17", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"The [default] mapping cannot be updated on index [logstash-aws-alb-logs-2019.04.17]: defaults mappings are not useful anymore now that indices can have at most one type."}}}}


#2

Are you using a template for your elasticsearch output? If so, what does it look like?


(Moshe Nadler) #3

No template.


(Moshe Nadler) #4

Needed to delete the old logstash template in elsticsearch and restart one of the logstash pods. This recreated the template of the logstash 7.0.0 version and now it works.