If you’ve recently upgraded to Elasticsearch 2.0 and Logstash 2.0, you may find that Logstash is no longer able to create indexes in Elasticsearch, as evidenced by the following error in the Elasticsearch logs.
MapperParsingException[Mapping definition for [geoip] has unsupported parameters: [path : full]]
This error was due to a bug in the elasticsearch output plugin of Logstash 2.0 which has since been fixed, but your logstash template within Elasticsearch might still contain the old mapping.
To remedy the situation, run the following command to prune the old template:
curl -XDELETE http://localhost:9200/_template/logstash?pretty
That should do it.
4 thoughts on “Inability to create new Logstash indexes in Elasticsearch 2.0”
Thanks Brandon. I’m deploying ES2 directly (ie. not migrating from an older ES), and still seeing this logstash template with the old path=full. Just trying to find where it’s being created/set.
Michael what version of Logstash are you using?
Ah – right:
root@michael-local-machine-5:~# /opt/logstash/bin/logstash –version
That would be it. I’ve updated ES to 2.0 and Kibana to 3, but not logstash.