Logstash "Rejected mapping update", not sure how to rectify the situation

Elastic Stack Logstash
1

I am seeing an error:

Rejecting mapping update to [logstash-INDEXNAME-2021.08.03] as the final mapping would have more than 1 type: [_doc, doc]

I suspect this is due to me switching my template from using doc to using _doc, but I deleted the index in question and recreated it to no effect. Furthermore I have a test system with an index template that uses _doc that is not having the same issue. So I do not understand why it is happening in the one system but not the other, and how I can rectify the error.

2

I guess I should be using document_type in the ES output, or "doc" in the template?

But that does not explain why it works on my test system without issue...

3

Yep most likely.

What does your Logstash pipeline config look like?

4

Neither the input nor output are specifying the type. For some reason the index template is not applying in my test environment, but is in my production environment.

5

Have you tried removing the type from the template definition?

6

That is basically what I did, I created the template with include_type_name=false. The only fix I can see is to use include_type_name=true and specify the type as "doc". This is Logstash/Elastic 6.8 btw.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.