Upgraded to v6.8 recently; trying to ensure I can now upgrade to v7.x Having an issue when trying to reindex my old logstash indexes created on v5.6.x - getting this message when the system goes to create the new index (using the "7.0 Upgrade Assistant" thru Kibana):
[mapper_parsing_exception] [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.
Is there a way to get rid of the _all mapping on the current indexes? (Sorry, have been running ELK stack for a while, but never dug deep into Elasticsearch... getting my education now!) Or, how else could I handle this error?
Looks like I also have a similar issue with Logstash writing to ES as well --
[2022-01-24T13:35:37,059][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2022.01.24", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x5d051aa4>], :response=>{"index"=>{"_index"=>"logstash-2022.01.24", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}
So I see the "logstash" one has a 'version' from v5.0; If I list this template, I see it does indeed have the _all field, included from the (now-deprecated) _default_ mapping
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.