8

Caught exception while performing bulk operation to ElasticSearch:

Elasticsearch.Net.ElasticsearchClientException: Request failed to execute. Call: Status code 400 from: POST /_bulk. ServerError: Type: illegal_argument_exception Reason: "Action/metadata line [1] contains an unknown parameter [_type]" at Elasticsearch.Net.Transport1.HandleElasticsearchClientException(RequestData data, Exception clientException, IElasticsearchResponse response) at Elasticsearch.Net.Transport1.FinalizeResponse[TResponse](RequestData requestData, IRequestPipeline pipeline, List1 seenExceptions, TResponse response) at Elasticsearch.Net.Transport1.RequestAsync[TResponse](HttpMethod method, String path, CancellationToken cancellationToken, PostData data, IRequestParameters requestParameters) at Serilog.Sinks.Elasticsearch.ElasticsearchSink.EmitBatchAsync(IEnumerable1 events)

I am getting this error when Serilog tries to log to ElasticSearch version 8.0. According to the documentation, ElasticSearch 8.0 no longer supports mapping types.

Is there any configuration to skip mapping types?

Ruben Bartelink
  • 59,778
  • 26
  • 187
  • 249
pkofos
  • 109
  • 1
  • 6

1 Answers1

8

In ElasticsearchSinkOptions you can zet TypeName = null If that is set null _type is not passed when sending data to Elastic.

See the answer on github: https://github.com/serilog-contrib/serilog-sinks-elasticsearch/issues/375#issuecomment-743372374

birdy1980
  • 317
  • 1
  • 10
  • 2
    Already tried that but didn't work. Probably they need to update the packages for official support of Elastic 8 – pkofos Mar 02 '22 at 07:38
  • From v8.0.0 of `Serilog.Sinks.Elasticsearch` no longer throws an exception when setting typename to null as per the 8.0.0 PR https://github.com/serilog-contrib/serilog-sinks-elasticsearch/commit/dc39b861df5fdd4077aef36fa8da7e937a213040#diff-443dc8ee5c8054547a027b63492a703f9341e583fc6756af7f4f28067d7ee0aa. Using this or higher versions and setting typename to null works for in my experience, at least with Elasticsearch 8.5.3 running off Elastic Cloud. For the record works against v7.17.x clusters as well – Frederik Struck-Schøning Jan 19 '23 at 14:12