I am building a new cluster and have copied out my existing template to use for importing into the new cluster:
{
"template": "logstash-",
"order": 0,
"settings": {
"number_of_shards": 4, <-- ONLY CHANGE
"number_of_replicas": 0, <-- ONLY CHANGE
"index": {
"refresh_interval": "5s"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"message_field": {
"mapping": {
"fielddata": {
"format": "disabled"
},
"index": "analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "message"
}
},
{
"string_fields": {
"mapping": {
"fielddata": {
"format": "disabled"
},
"index": "analyzed",
"omit_norms": true,
"type": "string",
"fields": {
"raw": {
"ignore_above": 256,
"index": "not_analyzed",
"type": "string"
}
}
},
"match_mapping_type": "string",
"match": ""
}
}
],
"_all": {
"omit_norms": true,
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "float"
}
}
},
"@version": {
"index": "not_analyzed",
"type": "string"
}
}
}
},
"aliases": {}
}
}
I pulled this directly from an existing, working setup and when I attempt to PUT it, via Kibana, I get this:
{
"error": {
"root_cause": [
{
"type": "remote_transport_exception",
"reason": "[########][x.x.x.x:9300][indices:admin/template/put]"
}
],
"type": "illegal_argument_exception",
"reason": "unknown setting [index.mappings.default._all.enabled] please check that any required plugins are installed, or check the breaking changes documentation for removed settings"
},
"status": 400
}
Both clusters are 5.1.2.
Can anyone please tell me why on Earth this isn't working?
). I've since found out that I had made a mistake which I also see in your json. The "mappings" (and I suspect also "aliases") should be moved outside the "settings" object, so that they come after "settings" instead of within.