Mapper Parsing Exception after Upgrade to 5.1.1

Elastic Stack Elasticsearch
1

I recently upgraded from ES 2.4.1 to ES 5.1.1 (along with Kibana, & logstash now at 5.1.1) and am getting mapper parsing exceptions;

{"index"=>{"_index"=>"filebeat-2016.12.22", "_type"=>"stunnel", "_id"=>"AVkohgLnKCAslFsq6wTS", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Can't parse [index] value [not_analyzed] for field [version], expected [true] or [false]"}}}}, :level=>:warn}

This is occurring on basically all of my 'types' for this index.

Using Sense, I can query the mapping for this index and type, but unsure of what I need to change in this mapping.

      "stunnel": {
    "_all": {
      "enabled": true,
      "norms": false
    },
    "dynamic_templates": [
      {
        "template1": {
          "match": "*",
          "mapping": {
            "doc_values": true,
            "ignore_above": 1024,
            "index": "not_analyzed",
            "type": "{dynamic_type}"
          }
        }
      }
    ],
    "properties": {
      "@timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "@version": {
        "type": "string",
        "index": "not_analyzed",
        "ignore_above": 1024,
        "fielddata": false

do I want to update version: index as such;

      "@version": {
        "type": "string",
        "index": "false",
        "ignore_above": 1024,
        "fielddata": false

This is happening for every 'type' I have in this index.

2

I had exactly the same problem, can't fix by now.

3

Yeah I can't figure it out, probably going to just downgrade to 2.4 as I'm not getting much assistance in this forum anymore. If I get it figured out I'll post here!

4

I think it's cause "string" type present in mappings is not correctly mapped in the new way.

String type should be changed to:
{ "type": "text",
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}

In my case when i tried to charge the snapshot of my old index in elastic5, the restore operation works fine, cause old mappings should be well interpreted, but in the execution of my app, when the app was going to use the new index it crashed with the same error as you.

I do a workaround, restoring the old index in the new elastic5 instance but in other index, and next reindex my data in the rigth index precreated with the correct mapping.

5

The problem is:

Can't parse [index] value [not_analyzed] for field [version], expected [true] or [false]

So you need to remove "index": "not_analyzed".
Actually may be remove template1?

6

Did someone find a solution to this issue?

Recently, I upgraded from ElasticSearch 2.4.4 to 5.2.0 and though my indexes got upgraded but new inserts are failing with error message seen by others.

Any solution found would be greatly appreciated.

Regards,
Sagar

7

I use this workaround:
Restore the old index in the new elastic5 instance in a index without mapping, and next reindex my data in an index with the mapping I want to use.

8

Can you please share more specific commands used for your environment, so that I can get some better understanding of what you have been doing?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.