After trying to track down why some data wasn't showing up, I found the following warning message in my logstash file:
[2017-02-22T21:34:23,198][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2017.02.23", :_type=>"cisco-wlc", :_routing=>nil}, 2017-02-23T03:34:23.184Z log.d35.org Feb 22 21:34:22 cisco-capwap-controller.d35.org GCS-WLC-5508-01: *dot1xMsgTask: Feb 22 21:34:22.587: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:509 Max EAPOL-key M5 retransmissions exceeded for client 10:9a:dd:a2:9a:45], :response=>{"index"=>{"_index"=>"logstash-2017.02.23", "_type"=>"cisco-wlc", "_id"=>"AVppCLbYuDat7D6I1xDm", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Mapper for [@timestamp] conflicts with existing mapping in other types:\n[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]"}}}}
It looks like the error is due to: Mapper for [@timestamp] conflicts with existing mapping in other types:\n[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]
I looked at https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html#merging-conflicts but am not able to figure out exactly what needs to be put in to fix the issue. All my indicies show @timestamp of type date.
Would anyone be able to share some tips for what I am missing?