Mapper_parsing_exception with template

Elastic Stack Elasticsearch
1

Hello,

i am updated my cluster from 5.6.1 to 6.1.1 and i am not able to create new index if i use template

My template

PUT _template/tds_audit 
{
    "order": 0,
    "index_patterns": "logstash-tds_audit*",
    "settings": {
      "index.number_of_shards": "4"
    },
    "mappings": {
      "tds_audit": {
        "properties": {
          "operationResponseTime": {
            "type": "double"
          },
          "timeOnWorkQ": {
            "type": "double"
          },
          "rdbmLockWaitTime": {
            "type": "double"
          },
          "clientIOTime": {
            "type": "double"
          },
          "numberOfEntriesReturned": {
            "type": "long"
          },
          "client_ip": {
            "type": "ip"
        }
      }
    }
  }
}

now i trying to create an index
PUT logstash-tds_audit-200

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."
    }
  },
  "status": 400
}

i don't undestand why the "default" mapping still exists

any ideas ?

Regards
Florent

2

Do you have other templates present in ES? What does GET _template yield?

1 Like
3

yes i have many other template.
What should i check ?

4

Arrgh i found an old template from logstash

  "logstash": {
    "order": 0,
    "version": 50001,
    "index_patterns": [
      "logstash-*"
    ],
    "settings": {
      "index": {
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "_default_": {
        "_all": {
          "enabled": true,
          "norms": false
        },
....

can i delete it or logstash should update this one ?

5

Ok, then you definitely have one template whose pattern also matches logstash-tds_audit-200 but whose definition is not 6.1.1 compatible

6

You can delete it manually but you also need to figure out which logstash is managing it and make sure it updates it to something that is compatible with 6.1.1, i.e. make sure that Logstash does not recreate that old template

7

I confirm that we can delete the template "logstash" created by logstash 5.X, it seems thats in 6.X the template is called "logstash-index-template"

the problem is solved after removed this old template

8

Cool, glad you figured it out!

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.