Rollover index creation failed after upgrade from 2.4.6 to 5.6.3

Elastic Stack Elasticsearch
1

Upgraded a 2.4.6 cluster yesterday to 5.6.3, no problem logstash was happy until tonight when it had to create a new index, then it started complain about ip fields in various indexes, that it didn't like a 'omit_norms: true', so inorder to fix I wanted to change the various templates only this elutes me somehow...

Whats wrong here:

 [root@cbdA es5]# curl -s -XPUT 'http://cbdA:9200/_template/apacheaccess' -d@apacheaccess.template.json | jq .
 {
   "error": {
     "root_cause": [
       {
         "type": "action_request_validation_exception",
         "reason": "Validation Failed: 1: template is missing;"
       }
     ],
     "type": "action_request_validation_exception",
     "reason": "Validation Failed: 1: template is missing;"
   },
   "status": 400
 }
 
 [root@cbdA es5]# cat apacheaccess.template.json 
 {
   "apacheaccess": {
     "order": 0,
     "template": "apacheaccess-*",
     "settings": {
       "index": {
         "number_of_shards": "1",
         "refresh_interval": "5s"
       }
     },
     "mappings": {
       "_default_": {
         "dynamic_templates": [
           {
             "template1": {
               "mapping": {
                 "ignore_above": 64,
                 "index": "not_analyzed",
                 "omit_norms": "true",
                 "type": "{dynamic_type}",
                 "doc_values": true
               },
               "match": "*"
             }
           }
         ],
         "_all": {
           "norms": {
             "enabled": false
           },
           "enabled": true
         },
         "properties": {
           "@timestamp": {
             "type": "date"
           },
           "host": {
             "index": "not_analyzed",
             "omit_norms": "true",
             "type": "string"
           },
           "geoip": {
             "properties": {
               "location": {
                 "type": "geo_point"
               },
               "ip": {
                 "type": "ip",
                 "index": "not_analyzed"
               }
             }
           }
         }
       }
     },
     "aliases": {}
   }
 }

Ok changing template to this still fails:

[root@cbdA es5]# curl -s -XPUT 'http://cbdA:9200/_template/apacheaccess' -d@apacheaccess.template.json | jq .
{
  "error": "Content-Type header [application/x-www-form-urlencoded] is not supported",
  "status": 406
}

[root@cbdA es5]# cat apacheaccess.template.json 
    "template": "apacheaccess-*",
    "settings": {
      "index": {
        "number_of_shards": "1",
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "_default_": {
        "dynamic_templates": [
          {
            "template1": {
              "mapping": {
                "ignore_above": 64,
                "index": "not_analyzed",
                "omit_norms": "true",
                "type": "{dynamic_type}",
                "doc_values": true
              },
              "match": "*"
            }
          }
        ],
        "_all": {
          "norms": {
            "enabled": false
          },
          "enabled": true
        },
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "host": {
            "index": "not_analyzed",
            "omit_norms": "true",
            "type": "string"
          },
          "geoip": {
            "properties": {
              "location": {
                "type": "geo_point"
              },
              "ip": {
                "type": "ip",
                "index": "not_analyzed"
              }
            }
          }
        }
      }
    },
    "aliases": {}
  }
2

:wink: was missing the opening curly bracket

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.