Upgrading Logstash from 6.0.0 to 6.7.2 second type being passed

Elastic Stack Logstash
1

I have upgraded to 6.7.2 from 6.7.2 of logstash where I am now receiving the following error

Rejecting mapping update to [logstash-2019.05.11] as the final mapping would have more than 1 type: [log4net, doc]"
the config has not changed. Does anyone know why this as occurred and how do I stop the second type being sent through.

I have rolled back to 6.0.0 for the time being.

2

You could start by reading this which covers the why, the when, and what your options are. The release notes say there were related changes to the elasticsearch plugin in 6.1.0.

3

Hi Badger,

I followed the link you sent and I tried to set the index to be typeless by setting include_type_name to false.

I am still getting the same message. In our events we do pass a field called type. Any other suggestions?

4

I have tried using a script to change the value of type. I have even tried dropping the type field that is passed from the event and adding a new field for type but I still get the 2 type error.

has anyone got any more suggestions?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.