Create Elasticsearch template without mapping

Question

I need to create a template to have some common index settings for a single node Elasticsearch cluster. When I run the following query, it works fine, however, the new index has empty mapping therefore it rejects all input.

I believe it overrides the index settings and removes all mappings.

PUT /_template/logstash
{
  "index_patterns": ["logstash-*"],
  "order" : 0,
  "settings": {
    "index": {
      "number_of_replicas": 0
    }
  }
}

Here is the glimpse of the errors I am getting:

{"type": "server", "timestamp": "2019-12-23T02:06:12,383Z", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "elasticsearch-cluster", "node.name": "elasticsearch", "message": "[logstash-2019.12.23][0] failed to execute bulk item (index) index {[logstash-2019.12.23][logevent][oGSBMG8Bk2kiyC1FN2uU], source[{\"@timestamp\":\"2019-12-23T05:04:44.0042561+03:00\",\"level\":\"Information\",\"messageTemplate\":\"HalalahContactService: Mobile Number: 123456789\",\"message\":\"ContactService: Mobile Number: 123456789\",\"fields\":{\"CorrelationId\":\"123456789\",\"MachineName\":\"INTERNAL-API02\"}}]}", "cluster.uuid": "1p7WBSRcQ6iCEJYflcALEQ", "node.id": "5nVSS69WRCiF_v3NsmsCHQ" ,
"stacktrace": ["java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2019.12.23] as the final mapping would have more than 1 type: [_doc, logevent]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:272) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:238) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:702) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:324) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:219) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.access$000(MasterService.java:73) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:151) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:703) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:252) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:215) [elasticsearch-7.5.1.jar:7.5.1]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]",
"at java.lang.Thread.run(Thread.java:830) [?:?]"] }

Answer 1

Ah, so your error message says it all!

Your custom index template is not really the issue, documents that are being indexed are. Since version 7, Elasticsearch no longer allows multiple types per index, just a single one ( _doc as a default for now) and later will remove them completely.

So the issue really is that type, other than default, probably logevent , is being attempted to be indexed. Make these index type consistent and it'll work.