unable to create template following is my template.
#! Deprecation: [types removal] The parameter include_type_name should be explicitly specified in get template requests to prepare for 7.0. In 7.0 include_type_name will default to 'false', which means responses will omit the type name in mapping definitions.
{
"logstash" : {
"order" : 0,
"index_patterns" : [
"logstash*"
],
"settings" : {
"index" : {
"analysis" : {
"filter" : {
"firsttoken" : {
"type" : "pattern_capture",
"preserve_original" : "false",
"patterns" : [
"""^([^.]).?."""
]
},
"secondtoken" : {
"type" : "pattern_capture",
"preserve_original" : "false",
"patterns" : [
"""^[^\.]*\.([^\.]*)\.?.*"""
]
},
"thirdtoken" : {
"type" : "pattern_capture",
"preserve_original" : "false",
"patterns" : [
"""^[^.].[^.].([^.]).?.$"""
]
}
},
"analyzer" : {
"firsttoken" : {
"filter" : [
"firsttoken"
],
"tokenizer" : "keyword"
},
"secondtoken" : {
"filter" : [
"secondtoken"
],
"tokenizer" : "keyword"
},
"thirdtoken" : {
"filter" : [
"thirdtoken"
],
"tokenizer" : "keyword"
}
}
}
}
},
"mappings" : {
"dynamic" : false,
"events" : {
"properties" : {
"msg" : {
"type" : "text",
"fields" : {
"raw" : {
"type" : "keyword"
}
}
},
"requestId" : {
"type" : "keyword"
},
"logger" : {
"type" : "keyword"
},
"host" : {
"type" : "keyword"
},
"jwtOwner" : {
"type" : "keyword"
},
"requestOriginator" : {
"type" : "keyword"
},
"tag" : {
"analyzer" : "firsttoken",
"fields" : {
"disambiguator" : {
"analyzer" : "keyword",
"type" : "text"
}
},
"type" : "text"
},
"jwtAuthenticatedUser" : {
"type" : "keyword"
},
"thread" : {
"type" : "keyword"
},
"requestChainOriginator" : {
"type" : "keyword"
},
"revision" : {
"type" : "keyword"
}
}
}
},
"aliases" : { }
}
}
Error message:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [events : {properties={requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [events : {properties={requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [events : {properties={requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
}
},
"status": 400
}
The template is from elasticsearch 6 and trying to import to new version elasticsearch 7.
Could anyone help me? Thanks in advance.