Problem with writing to created index

Elastic Stack Logstash
1

Hello i have used lates ES with latest logstash, and i have this kind of problem.
When i try to write my logs to ES i receive this error. i have old ES5, and don't have any problem with configuration files. This is fully new ES cluster.

Jan 11 13:08:00 ny-mon4.picsart.loc logstash[23140]: [2018-01-11T13:08:00,746][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"nginx_error-2018.01", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x5b778c7c>], :response=>{"index"=>{"_index"=>"nginx_error-2018.01", "_type"=>"doc", "_id"=>"JIZV5WABwf1E9dYkmdHQ", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [timestamp] of different type, current_type [date], merged_type [text]"}}}}

This is template which i used on cluster
PUT /_template/template_1
{
"index_patterns" : ["*"],
"order" : 0,
"settings" : {
"index.refresh_interval" : "30s",
"number_of_shards" : "10",
"number_of_replicas" : "0",
"index.store.type": "mmapfs"
}
}

2

This looks like a symptom of reindexing data from the previous cluster into the new cluster and hitting some breaking changes.

This document should help with mapping in the current version.
https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html

Is this the whole template?

Do you have a custom logstash filter for this data?

What version of Elasticsearch is the new cluster running?

Did you re index any templates or data into the new cluster?

3

Hi, yes, that is whole template, i use ES 6.1.1 and i don't have any specific filter for logstash. I will try reinstall cluster maybe something goes wrong during installation.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.