# Mapper\_parsing\_exception", "reason"=\>"\[include\_in\_all - is not allowed for indices created on or after version 6.0.0 **URL:** \ **Category:** Logstash\ **Created:** [November 29, 2017, 12:05pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586 "2017-11-29T12:05:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [November 29, 2017, 12:05pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/1 "2017-11-29T12:05:27Z")
Hi, I get the following error: > [2017-11-29T12:43:23,143][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\> "logstash-2017.11.29", :\_type=\>"syslog", :\_routing=\>nil}, #\], :response=\>{"index"=\>{"\_index"=\>"logstash-2017.11.29", "\_type"=\>"syslo g", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "re ason"=\>"Failed to parse mapping [_default_]: [include\_in\_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replace ment, you can use an [copy\_to] on mapping fields to create your own catch all fi eld.", "caused\_by"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"[include\_in_ all] is not allowed for indices created on or after version 6.0.0 as [\_all] is d eprecated. As a replacement, you can use an [copy\_to] on mapping fields to creat e your own catch all field."}}}}} What does it excatly mean. In 5.6 everything worked fine. Is there problem in the conf.d folder and files? inputOutput.conf: > syslog { > type =\> "syslog" > port =\> 5514 > } > udp { > type =\> "syslog" > port =\> 5140 > } > tcp { > type =\> "syslog" > port =\> 5140 > } > beats { > port =\> 5044 > } > udp { > type =\> "syslog" > port =\> 5515 > > } > } > > output { > if [@metadata][beat] { > elasticsearch { > hosts =\> "localhost:9200" > manage\_template =\> false > index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" > document\_type =\> "%{[@metadata][type]}" > } > } else { > elasticsearch { > hosts =\> "localhost:9200" > manage\_template =\> false > index =\> "logstash-%{+YYYY.MM.dd}" > } > } > } I can provide all other files of course if needed. Thanks, ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 29, 2017, 12:33pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/2 "2017-11-29T12:33:51Z")
In Elasticsearch 6.0 the `_all` field is disabled/deprecated as outlined in the [section in the docs about breaking mapping changes](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking_60_mappings_changes.html). ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [November 29, 2017, 12:41pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/3 "2017-11-29T12:41:12Z")
I read that in this moment....now I have to understand what it excactly means. I have the following files: inputOutput.conf -\> [https://pastebin.com/w0kN811p](https://pastebin.com/w0kN811p) 10-syslog.conf -\> [https://pastebin.com/7wbLuNVU](https://pastebin.com/7wbLuNVU) 11-pfsense.conf -\> [https://pastebin.com/8fttPiiq](https://pastebin.com/8fttPiiq) How can I now check that if there is such an all\_field? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 29, 2017, 1:07pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/4 "2017-11-29T13:07:22Z")
It seems you are using `include_in_all` in your mapping template, which is causing this. ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [November 29, 2017, 1:22pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/5 "2017-11-29T13:22:33Z")
You're right. My logstash template looks like that. [https://pastebin.com/sgHbcAkc](https://pastebin.com/sgHbcAkc) I have deleted it now. But now I have to create a new one. What parameters would you set? I have "\_all": { and "include\_in\_all": false but I don't know why. I have never set that as far as i know. I updated from 5.2 to 5.4 and from 5.4 to 5.6 and now 6. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 29, 2017, 1:25pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/6 "2017-11-29T13:25:21Z")
You probably should upgrade to Logstash 6.0 and use the template that comes with it, as it looks like you are using the default Logstash template. ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [November 29, 2017, 1:45pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/7 "2017-11-29T13:45:29Z")
Thanks this worked. I have used: [https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es6x.json](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es6x.json) I hope this was the correct one? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2017, 1:45pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-reason-include-in-all-is-not-allowed-for-indices-created-on-or-after-version-6-0-0/109586/8 "2017-12-27T13:45:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.