Logstash index issue after 5.x to 6.2 upgrade


#1

Hello, all.

Yesterday, I upgraded my Elastic stack from version 5.x to 6.2, and today, my logstash (and filebeat) indices no longer work. Here's some output from elasticsearch.log:

[2018-02-08T00:03:29,150][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.02.08", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x6297d867], :response=>{"index"=>{"_index"=>"logstash-2018.02.08", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [default]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}

I've googled extensively, but can't seem to come up with a solution. I would appreciate your (very detailed) help in getting back to good.

Many thanks.


(Magnus B├Ąck) #2

This is really more of an Elasticsearch question. Your problem just happens to show up when using Logstash and Filebeat.


#3

Thanks, Magnus. I'll post there.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.