Hi,
I get the following error:
[2017-11-29T12:43:23,143][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=> "logstash-2017.11.29", :_type=>"syslog", :_routing=>nil}, #<LogStash::Event:0x60 16b71a>], :response=>{"index"=>{"_index"=>"logstash-2017.11.29", "_type"=>"syslo g", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "re ason"=>"Failed to parse mapping [default]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [all] is deprecated. As a replace ment, you can use an [copy_to] on mapping fields to create your own catch all fi eld.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in all] is not allowed for indices created on or after version 6.0.0 as [_all] is d eprecated. As a replacement, you can use an [copy_to] on mapping fields to creat e your own catch all field."}}}}}
What does it excatly mean. In 5.6 everything worked fine. Is there problem in the conf.d folder and files?
inputOutput.conf:
syslog {
type => "syslog"
port => 5514
}
udp {
type => "syslog"
port => 5140
}
tcp {
type => "syslog"
port => 5140
}
beats {
port => 5044
}
udp {
type => "syslog"
port => 5515}
}output {
if [@metadata][beat] {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
} else {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "logstash-%{+YYYY.MM.dd}"
}
}
}
I can provide all other files of course if needed.
Thanks,