We are using the docker images of the elastic stack. we were upgrading from 6.0.0 to 6.2.1 and when we did, some of our nodes were logging a bunch of errors reporting that they were failing to bulk index the security audit logs. we had to downgrade to 6.1.3 in order for the errors to go away. below are the errors that were reported. Because we are using the docker images, i'm guessing that there is no need to upgrade XPack as the image comes with it. We are using the docker images provided by Elastic.co
[2018-02-09T21:06:17,276][INFO ][o.e.x.s.a.i.IndexAuditTrail] [hlvBERy] failed to bulk index audit events: [failure in bulk execution:
[0]: index [.security_audit_log-2018.02.09], type [doc], id [-2tjfGEBxtj2NAbo5pYd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[1]: index [.security_audit_log-2018.02.09], type [doc], id [_GtjfGEBxtj2NAbo5pYd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[2]: index [.security_audit_log-2018.02.09], type [doc], id [_WtjfGEBxtj2NAbo5pYd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[6]: index [.security_audit_log-2018.02.09], type [doc], id [AWtjfGEBxtj2NAbo5pcd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[7]: index [.security_audit_log-2018.02.09], type [doc], id [AmtjfGEBxtj2NAbo5pcd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[8]: index [.security_audit_log-2018.02.09], type [doc], id [A2tjfGEBxtj2NAbo5pcd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
[9]: index [.security_audit_log-2018.02.09], type [doc], id [BGtjfGEBxtj2NAbo5pcd], message [StrictDynamicMappingException[mapping set to strict, dynamic introduction of [roles] within [doc] is not allowed]]
... and so on