Upgrade check

Elastic Stack Elasticsearch
1

I ran the upgrade checker (5.6.3) and get these mapping warnings:

one or more templates use deprecated mapping settings
This issue must be resolved to upgrade. Read Documentation
Details: {.monitoring-es=[Coercion of boolean fields], .marvel-es=[Coercion of boolean fields], .monitoring-kibana-2=[Coercion of boolean fields], metrics_template=[Coercion of boolean fields], .monitoring-logstash-2=[Coercion of boolean fields], .watch-history-6=[Coercion of boolean fields], .monitoring-kibana=[Coercion of boolean fields], security-index-template=[Coercion of boolean fields], .monitoring-logstash=[Coercion of boolean fields], logstash=[The _all meta field is disabled by default on indices created in 6.0, Unrecognized match_mapping_type options not silently ignored], .monitoring-es-2=[Coercion of boolean fields], .ml-anomalies-=[Coercion of boolean fields], metrics=[Coercion of boolean fields]}

all of these are created by ELK itself - I have read the docs and understand the coercion change - but do I really as a user have to handle this myself? Is it not something the ELK components will handle at upgrade (replace the mapping). Also for existing data - will you have a reindex fix?

Seems a bit of a hassle if all users need to handle this manually themselves.

2

We have exactly the same scenario here - it would be good to understand what it is we can do to fix this (if required) ahead of a cluster upgrade especially as it is supposedly possible to perform a rolling upgrade from 5.6.x to 6.0.

3

Same here - I'd like to know if we could just delete the templates and that ES/LS/Kibana will create them automatically again, correctly.

4

And I don't quite get the implications of the coercion change - eg, for the .monitoring-es template, what is wrong with it? I can see there are some fields defined as type "boolean". I can see two other fields ("date_detection" and "dynamic") set to false (without quotes) - is that the problem? Should they be using quotes around "false"? I can't see any use of the other previously acceptable values (yes, no, etc).

EDIT: After some tests, it seems to be the fields of type "boolean" that have caused the templates to be flagged. So what needs to be done to make them acceptable for v6?

5

Has anyone had success with this? Or any advice to give? Anyone?

We're keen to upgrade a cluster to v6, but won't commence until we know how to resolve these issues.