Indexer Failures after upgrade to 2.3.1

[shines2 (Shaun Hines)]

I upgraded graylog to 2.3.1 and elasticsearch from 2 to 5.2.

According to the graylog console it can connect fine esearch after the upgrade, but now when I attempt to send syslog data I get the following index errors:

{"type":"mapper_parsing_exception","reason":"failed to parse","caused_by":{"type":"illegal_argument_exception","reason":"Can't parse [index] value [not_analyzed] for field [facility], expected [true] or [false]"}}

Did I forget to perform a post upgrade step?

[shines2 (Shaun Hines)]

I resolved the issue by rotating the index.

Can someone explain why it was necessary to rotate the index?

[jochen]

Because there were breaking changes in the index mapping between Elasticsearch 2.x and 5.x.

Please refer to https://www.elastic.co/guide/en/elasticsearch/reference/5.5/breaking-changes-5.0.html for details.