Resolving deprecation warnings to allow us to upgrade

Elastic Stack Elasticsearch
1

I am currently going through the Elasticsearch deprecation logs to check what we may need to resolve prior to upgrading our ELK Stack from v6.0.0 where I have found the following but have no clue how to resolve.

[o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index_patterns]
Deprecated field [inline] used, expected [source] instead
[_default_] mapping is deprecated since it is not useful anymore now that indexes cannot have more than one type
Fielddata access on the _uid field is deprecated, use _id instead

Looking at the fields _id is currently being used.
Index_patterns is displayed when doing GET _template
Inline is also not being used

We have not set a custom template in logstash it uses its default.

Can anyone shed any light?

2

I have same problem but no answer that I found when I posted. then I got side track

Deprecated field [template] used, replaced by [index_patterns]

I can't seems to find what and where this is used and how do I fix.

3

Interestingly I have spun up another ELK node with the same version (v6.0.0) where I got the same errors as my original comment. I proceeded with the upgrade to v6.7.1 on the test ELK node to see if any errors cleared and I am only seeing
[2019-04-24T08:53:16,101][WARN ][o.e.d.i.m.MapperService ] [HOSTNAME] [_default_] mapping is deprecated since it is not useful anymore now that indexes cannot have more than one type

> [2019-04-24T08:01:32,614][WARN ][o.e.d.r.a.a.i.RestGetMappingAction] [HOSTNAME] [types removal] The parameter include_type_name should be explicitly specified in get mapping requests to prepare for 7.0. In 7.0 include_type_name will default to 'false', which means responses will omit the type name in mapping definitions.

The question is now 'How do I resolve the include_type_name error and the default mapping error?

4

You can resolve the [_default_] mapping warning by removing all usages of this feature from your index mappings and index templates.

You can resolve the include_type_name thing by passing include_type_name=false along with any get mapping requests.

5

Hi David,

We do not specify a specific mapping we use the default logstash mapping. How do we remove the

> [_default_] mapping from being referenced in the output to elasticsearch same with the include_type_name

6

I'm pretty sure that the warning about the [_default_] mapping indicates that there's an index or an index template that's still using it. It might be a template installed by Logstash, of course. If so, I'm not sure how best to go about removing it but you could try asking in the Logstash forum about that.

As I said above, to avoid that warning any get mapping request needs include_type_name=false as per the docs.

7

Just upgraded my cluster to 6.7.1 and found exactly which template was putting error. I wasn't using that index anymore so it was easy for me and remove it

GET /_template/
DELETE /_template/

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.