Problem with writing to created index

Hello i have used lates ES with latest logstash, and i have this kind of problem.
When i try to write my logs to ES i receive this error. i have old ES5, and don't have any problem with configuration files. This is fully new ES cluster.

Jan 11 13:08:00 ny-mon4.picsart.loc logstash[23140]: [2018-01-11T13:08:00,746][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"nginx_error-2018.01", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x5b778c7c>], :response=>{"index"=>{"_index"=>"nginx_error-2018.01", "_type"=>"doc", "_id"=>"JIZV5WABwf1E9dYkmdHQ", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [timestamp] of different type, current_type [date], merged_type [text]"}}}}

This is template which i used on cluster
PUT /_template/template_1
{
"index_patterns" : ["*"],
"order" : 0,
"settings" : {
"index.refresh_interval" : "30s",
"number_of_shards" : "10",
"number_of_replicas" : "0",
"index.store.type": "mmapfs"
}
}

This looks like a symptom of reindexing data from the previous cluster into the new cluster and hitting some breaking changes.

This document should help with mapping in the current version.
https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html

Is this the whole template?

Do you have a custom logstash filter for this data?

What version of Elasticsearch is the new cluster running?

Did you re index any templates or data into the new cluster?

Hi, yes, that is whole template, i use ES 6.1.1 and i don't have any specific filter for logstash. I will try reinstall cluster maybe something goes wrong during installation.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.