This script will replace the elasticsearch mapping template named "logstash" (see line 3) and replace it with the below template from v1.3.2, which is currently at https://github.com/logstash/logstash/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json This template will fix the error LOGSTASH-1711 and the "indexed without…

fix_logstash-1.3.1_template.sh

#!/bin/bash

curl -XDELETE http://localhost:9200/_template/logstash?pretty=true

echo
echo "Deleted current logstash template..."

echo "Creating new logstash template..."
sleep 2

curl -XPUT http://localhost:9200/_template/logstash -d '
{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }
      }
    }
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true},
       "dynamic_templates" : [ {
         "string_fields" : {
           "match" : "*",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "multi_field",
               "fields" : {
                 "{name}" : {"type": "string", "index" : "analyzed", "omit_norms" : true },
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }
           }
         }
       } ],
       "properties" : {
         "@version": { "type": "string", "index": "not_analyzed" },
         "geoip"  : {
           "type" : "object",
             "dynamic": true,
             "path": "full",
             "properties" : {
               "ip" : { "type": "ip" },
               "location" : { "type" : "geo_point" }
             }
         }
       }
    }
  }
}
'
echo
echo "Done."