Description of the issue:
The 1.7 experimental wildcard mappings need to have the index attribute stripped from them. The one that was causing problems for me is here:
|
- name: stack_trace |
|
level: extended |
|
type: wildcard |
|
multi_fields: |
|
- name: text |
|
type: text |
|
norms: false |
|
default_field: false |
|
description: The stack trace of this error in plain text. |
|
index: true |
Here's the error I'm getting from Elasticsearch:
Failed to parse mapping: unknown parameter [index] on mapper [stack_trace] of type [wildcard]
Description of the issue:
The 1.7 experimental
wildcardmappings need to have theindexattribute stripped from them. The one that was causing problems for me is here:ecs/experimental/generated/beats/fields.ecs.yml
Lines 1154 to 1163 in 3edb6f2
Here's the error I'm getting from Elasticsearch: