Index template on upgraded 2.5 still has string fields

I am attempting to upgrade graylog from 2.2 to 2.5. I successfully upgraded Elasticsearch from 2 to 5 and re-indexed. After upgrading to Elasticsearch 6 the indexes which were re-indexed in ES 5 cannot be read by Grafana so I am attempting to re-index again in ES 6. However the graylog index template still has the message field as type string which is not supported by ES 6. On a fresh install of graylog 2.5 and ES 6 the index template correctly says message is type text. What did I miss? How do I get the correct index template on my upgraded instance?

you need to re-index from ES5 to ES6 to convert the indices.

I was able to delete _template/graylog-internal and replace it with the template from the fresh install. Then I was able to re-index in ES 6.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.