ELK由5.5.x升级到6.0.0的错误及其解决办法收集

一.升级完毕打开Logstash运行日志观察提示如下错误信息：

[2017-12-19T16:30:14,283][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-dev-elastic01-app-2017.11.30", :_type=>"app", :_routing=>nil}, #<LogStash::Event:0x16db134e @data={"@timestamp"=>2017-12-19T16:30:14.267Z, "port"=>23639, "@version"=>"1", "host"=>"ip-00-00-00-00.eu-central-1.compute.internal", "@metdata"=>{"ip_address"=>"00.00.00.00"}, "message"=>"{\"hostname\":\"app1\",\"env\":\"him1\",\"level\":\"info\",\"message\":\"executing job close-incidents-job\",\"label\":\"cron\"}", "type"=>"app"}>], :response=>{"index"=>{"_index"=>"logstash-dev-elastic01-app-2017.12.19", "_type"=>"app", "_id"=>nil, "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}}}}}

错误特征：

Kibana无法有效接收到由Elasticsearch传递过来的来自Logstash的日志

错误原因：

Elasticsearch配置中的logstash模板仍在使用5.5.0的旧模板，新版不兼容

解决方法：

1.服务器上使用curl删除旧模板：

curl -XDELETE 'http://10.0.7.227:9200/_template/logstash'

2.接着重启Logstash，自动重新生成适配6.0.0的模板