No documents added; missing index and parse error

Elastic Stack Elasticsearch
1

I upgraded our stack to 6.5.4 yesterday afternoon, and since that time, no new documents have been added to elasticsearch.

The logstash error log shows a slew of errors similar to this:
[2019-02-05T17:27:03,540][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status =>400, :action=>["index", {:_id=>nil, :index=>"logstash-2019.02.05", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x6256e156>], :response=>{"index"=>{"_index"=>"logstash-2019.02.05", "_type"=>"doc", "_id"=>nil, "_status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: No handler for type [string] declared on field [filter_host]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"No handler for type [string] declared on field [filter_host]"}}}}}

The template I'm using doesn't say to avoid auto-creation, and in fact the mapping includes (edited down to essentials):

logstash:
  order:           0
  index_patterns:
    0:          "logstash-*"
[-snip-]
  mappings:
    properties:
      filter_host:
        type:     "string"
        index:      "not_analyzed"

The index is definitely not there:

$ curl -XGET http://server:9200/logstash-2019.02.05/_mapping
{"error":"{"root_case::[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"logstash-2019.02.05","index":"logstash-2019.02.05"}],"type":"index_not_found_exception","reason":"no such index","index_uuid":"_na_","resource.type":"index_or_alias","resource.id":"logstash-2019.02.05","index":"logstash-2019.02.05"},"status":404}

So I'm not quite sure what the root cause is here. Is there a mapping error that's causing the index to not get created automatically, or is the index not existing causing the mapping error? Should I be looking at Elasticsearch or Logstash at this point?

2

Which version of Elasticsearch are you using? If its 5.x and above, string type has been dropped and replaced with text or keyword as per usecase. You may replace string with text in the mappings and it'll work.

3

Aha! Thanks. I'm on 6.5.4, so this definitely applies.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.