Mapping definition for [name] has unsupported parameters: [path : docker.container.image]

[realyn_elastic (Realyn Tagle)]

Hello team,

I am facing the following issue whenever I try to roll over the winlogbeat index. I checked my document, and couldn't find any field related to docker at all. I am using default template mapping that is being auto-created by winlogbeat.

{
  "reason": "Failed to parse mapping [_doc]: Mapping definition for [name] has unsupported parameters:  [path : docker.container.image]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Mapping definition for [name] has unsupported parameters:  [path : docker.container.image]"
}

Winlogbeat Version: 7.4.1
Elasticsearch Version: 7.5.1

Thanks

[andrewkroh]

Can you share the API request your are making to perform the rollover? I assume you are not using the automated ILM feature if you are calling _rollover, correct? Did you customize the index naming or index template patterns in any way?

You might want to check what templates present and see which ones apply to the new index being created. There might be some old template causing an issue.

[realyn_elastic (Realyn Tagle)]

Hello,

I was able to resolve this issue by deleting the default template that it was being called.
After deletion. I manually executed the rollover and it worked well