Unable to Setup Watcher in 6.2.1

Elastic Stack Elasticsearch
1

Hi all,

I have upgraded ELK from 6.0 to 6.2.1 and im trying to setup my first watcher. How ever it fails. following is the error.

"{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Rejecting mapping update to [.watches] as the final mapping would have more than 1 type: [watch, doc]"
}
],
"type": "illegal_argument_exception",
"reason": "Rejecting mapping update to [.watches] as the final mapping would have more than 1 type: [watch, doc]"
},
"status": 400
}"

Watcher :

PUT _xpack/watcher/watch/log_error_watch
{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "filebeat-*" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
}
}

Am i missing anything ? New to x-pack.

2

hey,

have you been upgrading from 5.x by any chance or did you start with 6.0? Did you run the migration assistance API and the migration upgrade API?

--Alex

3

Hey Alex,

I started with 6.0. But X-pack is installed and configured only after upgrading to 6.2.1.

But after installing i ran the upgrade api. It gave me following now.

GET /_xpack/migration/assistance

output :
{"indices": {}}

4

Can you share the output of (one of them should return something on 6.0)

GET _template?filter_path=**.template
GET _template?filter_path=**. index_patterns

I am especially interested if there is a watches index template. if that is the case you could try to delete that one together with the triggered_watches template. If you then delete your .watches index, you should be able to put a watch again.

--Alex

5

Alex, Here is the output for the

GET _template?filter_path=**.template

output :

{
".watch-history-6": {
"settings": {
"index": {
"xpack": {
"watcher": {
"template": {
"version": "6"
}
}
}
}
}
},
".watch-history-7": {
"settings": {
"index": {
"xpack": {
"watcher": {
"template": {
"version": "7"
}
}
}
}
}
}
}

6

I deleted the ".watch-history-6" template as well as triggered_watches template. How ever i couldn't find any .watches index.

So i tried again creating a watch and its still failing.

7

Hey,

what about the watches template and the second template call I asked for?

--Alex

8

Thanks Alex. It worked after deleting watches template.

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.