[WARN ][o.e.d.i.m.MapperService ] [unmapped_type:string] should be replaced with [unmapped_type:keyword]

Elastic Stack Elasticsearch
1

Hi,

how can I fix this ElasticSearch 5.2.2 Warning?

[WARN ][o.e.d.i.m.MapperService ] [unmapped_type:string] should be replaced with [unmapped_type:keyword]

This is my indices configuration: https://gist.github.com/harobed/e92fb7d131cac523067c26458d842184

Best regards,
Stéphane

2

Read the breaking changes doc. String type has been removed.

3

I use Logstash 5.2.2 and Kibana 5.2.2 on empty ES. This two tools are not compatible with ES 5.2.2 ?

4

They are but you probably upgraded or already have an old template?

5

No, my data are empty.

6

ES display that warning for logstash indice:

elasticsearch_1  | [2017-03-27T19:25:37,644][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [title]
elasticsearch_1  | [2017-03-27T19:25:37,649][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [timeFieldName]
elasticsearch_1  | [2017-03-27T19:25:37,655][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [intervalName]
elasticsearch_1  | [2017-03-27T19:25:37,658][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [fields]
elasticsearch_1  | [2017-03-27T19:25:37,661][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [sourceFilters]
elasticsearch_1  | [2017-03-27T19:25:37,662][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [fieldFormatMap]
elasticsearch_1  | [2017-03-27T19:25:37,673][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [title]
elasticsearch_1  | [2017-03-27T19:25:37,675][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [timeFieldName]
elasticsearch_1  | [2017-03-27T19:25:37,676][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [intervalName]
elasticsearch_1  | [2017-03-27T19:25:37,678][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [fields]
elasticsearch_1  | [2017-03-27T19:25:37,685][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [sourceFilters]
elasticsearch_1  | [2017-03-27T19:25:37,686][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [fieldFormatMap]

and for .kibana indice:

elasticsearch_1  | [2017-03-27T19:34:47,709][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [title]
elasticsearch_1  | [2017-03-27T19:34:47,714][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [description]
elasticsearch_1  | [2017-03-27T19:34:47,714][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [columns]
elasticsearch_1  | [2017-03-27T19:34:47,714][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [sort]
elasticsearch_1  | [2017-03-27T19:34:47,715][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [searchSourceJSON]
elasticsearch_1  | [2017-03-27T19:34:47,716][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [title]
elasticsearch_1  | [2017-03-27T19:34:47,720][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [description]
elasticsearch_1  | [2017-03-27T19:34:47,720][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [columns]
elasticsearch_1  | [2017-03-27T19:34:47,721][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [sort]
elasticsearch_1  | [2017-03-27T19:34:47,721][WARN ][o.e.d.i.m.StringFieldMapper$TypeParser] The [string] field is deprecated, please use [text] or [keyword] instead on [searchSourceJSON]
7

It can be that?

curl "http://localhost:9200/logstash-2017.03.27/?pretty=1"
{
  "logstash-2017.03.27" : {
    "aliases" : { },
    "mappings" : {
      "_default_" : {
        "_all" : {
          "enabled" : true,
          "norms" : false
        },
        "dynamic_templates" : [
          {
            "message_field" : {
              "path_match" : "message",
              "match_mapping_type" : "string",
              "mapping" : {
                "norms" : false,
                "type" : "text"
              }
            }
          },
          {
            "string_fields" : {
              "match" : "*",
              "match_mapping_type" : "string",
              "mapping" : {
                "fields" : {
                  "keyword" : {
                    "type" : "keyword"
                  }
                },
                "norms" : false,
                "type" : "text"
              }
            }
          }
        ],
...
8

But this template is correct.

Can you run a get cluster state query?

9

This gist:5c196be791eace13e343409907e780a6 · GitHub ?

10

Weird. I can't explain what you are seeing here.

BTW how do you know that the messages you saw are related to logstash or kibana indices?

Any chance you have old kibana instance which is trying to connect to your Elasticsearch cluster? Same for logstash?

11

I checked what Logstash 5.2.2 is sending to elasticsearch and it looks correct to me: https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/5.2.x/lib/logstash/outputs/elasticsearch/elasticsearch-template-es5x.json

12

I did:

$ rm es-data -rf

before restart my ES Docker. Then I think ES is empty :slight_smile:

13

I don't have other indices when I query _cat/indices.

14

Sure. But it does not mean that another old process is not trying to connect to this instance.

Let me sum up the situation so I understand the full picture.

You have one elasticsearch instance, running on docker, which is totally empty as you remove data dir before starting.
You start it. Then GET _cat/indices is totally empty?

Then you start Kibana 5.2.2 instance and it prints in your logs the message you pasted before. Is that right?

Then you start a Logstash 5.2.2 instance and it also prints similar log line. Still right?

Are Kibana and Logstash totally fresh new downloads from our website? Or did you upgrade them somehow?

15 
$ rm es-data/ -rf
$ docker-compose up -d elasticsearch
Creating elk_elasticsearch_1
curl http://127.0.0.1:9200/_cluster/health?pretty=1
{
  "cluster_name" : "santa-maria-log",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 0,
  "active_shards" : 0,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}
$ curl http://127.0.0.1:9200/_cat/indices

I have no indice.

Log before start kibana : after_kibana · GitHub

Now I start kibana and I see warning message if I open Kibana in my browser : after_kibana · GitHub

docker-compose.yaml file: after_kibana · GitHub

16

Same error with "official" images:

docker.elastic.co/elasticsearch/elasticsearch:5.3.0
docker.elastic.co/kibana/kibana:5.2.2
17

You can test with this repository: https://github.com/harobed/elk_warning

18

I have created this issue: https://github.com/elastic/kibana/issues/10993

19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.