Hi,
I’ve recently upgraded my ELK cluster from 6.6.2 to 7.3.2, running on ROR PRO 1.18.7.
After upgrade I deleted all readonlyrest_audit-* indices, as they were somehow UNITIALIZED.
Now there is problem, that readonlyrest_audit-* is empty.
I checked Elasticsearch logs and I see there following problem:
[2019-10-29T09:53:35,759][ERROR][t.b.r.e.p.EsAuditSink ] [esmaster02] Some failures flushing the BulkProcessor:
[2019-10-29T09:53:35,760][ERROR][t.b.r.e.p.EsAuditSink ] [esmaster02] 42x: java.lang.IllegalArgumentException: Rejecting mapping update to [readonlyrest_audit-2019-10-29] as the final mapping would have more
than 1 type: [_doc, ror_audit_evt]
Only dynamic default mapping is applied for index readonlyrest_audit-*:
“readonlyrest_audit-2019-10-29” : {
“mappings” : {
“dynamic_templates” : [
{
“port” : {
“match” : “-port",
“mapping” : {
“type” : “integer”
}
}
},
{
“ip” : {
“match” : "-ip”,
“mapping” : {
“type” : “ip”
}
}
},
{
“timestamp” : {
“match” : “timestamp",
“mapping” : {
“type” : “date”
}
}
},
{
“location” : {
“path_match” : “geoip.location”,
“mapping” : {
“type” : “geo_point”
}
}
},
{
“string_fields” : {
“match” : "”,
“match_mapping_type” : “string”,
“mapping” : {
“fields” : {
“fulltext” : {
“type” : “text”
}
},
“type” : “keyword”
}
}
}
]
}
}
Thank you for your help.