Rejecting mapping update to [****] as the final mapping would have more than 1 type

General Feedback
1

Hi all,

i am using Opensearch 1.1.0 version, it is upgraded from Elasticsearch 7.9.3. Opensearch is able to load indexes created on Elasticsearch version 7.9.3 and able to query the indexes properly.

But i am facing below issue when i ingest data using logstash version 7.9.3.

[logstash.outputs.elasticsearch][main][c8d7593139887984021db358962161bfdacaed12ca0c25d6ac384dcba8b0a4c3] Could not index event to Elasticsearch. {:status=>400, :action=>[“index”, {:_id=>nil, :_index=>““, :_routing=>nil, :_type=>“rsyslog”}, #LogStash::Event:0x3c4e874c], :response=>{“index”=>{”_index"=>"”, “_type”=>“rsyslog”, “_id”=>“MHfjW30B8fBZd5tmUIAU”, “status”=>400, “error”=>{“type”=>“illegal_argument_exception”, “reason”=>“Rejecting mapping update to [***] as the final mapping would have more than 1 type: [_doc, rsyslog]”}}}} .

could you please help to solve this issue?

Thanks.

2

It’s suggested to use a newer version of logstash with OpenSearch