Inability to create new Logstash indexes in Elasticsearch 2.0

If you’ve recently upgraded to Elasticsearch 2.0 and Logstash 2.0, you may find that Logstash is no longer able to create indexes in Elasticsearch, as evidenced by the following error in the Elasticsearch logs.

[code lang=text]
MapperParsingException[Mapping definition for [geoip] has unsupported parameters:  [path : full]]
[/code]

This error was due to a bug in the elasticsearch output plugin of Logstash 2.0 which has since been fixed, but your logstash template within Elasticsearch might still contain the old mapping.

To remedy the situation, run the following command to prune the old template:

[code lang=text]
curl -XDELETE http://localhost:9200/_template/logstash?pretty
[/code]

That should do it.

4 thoughts on “Inability to create new Logstash indexes in Elasticsearch 2.0”

  1. Thanks Brandon. I’m deploying ES2 directly (ie. not migrating from an older ES), and still seeing this logstash template with the old path=full. Just trying to find where it’s being created/set.

      1. Ah – right:
        root@michael-local-machine-5:~# /opt/logstash/bin/logstash –version
        logstash 1.4.2

        That would be it. I’ve updated ES to 2.0 and Kibana to 3, but not logstash.

Leave a Comment

Your email address will not be published.

Scroll to Top