got error fluentd metadata line [1] contains an unknown parameter [_type]

[arafdy]

hello im trying to install EFK (elasticsearch8 , fluentd , kibana8)
i installed elasticseacrh and kibana using elastic official helm
everything works good except fluentd

the fluentd got error

2025-02-28 13:29:26 +0000 [warn]: #0 failed to flush the buffer. retry_times=7 next_retry_time=2025-02-28 13:31:46 +0000 chunk="62f33c0d1f0ee33043319cb49a33648f" error_class=Fluent::Plugin::ElasticsearchOutput::RecoverableRequestFailure error="could not push logs to Elasticsearch cluster ({:host=>\"elasticsearch-master\", :port=>9200, :scheme=>\"https\", :user=>\"elastic\", :password=>\"obfuscated\", :path=>\"\"}): [400] {\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"Action/metadata line [1] contains an unknown parameter [_type]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"Action/metadata line [1] contains an unknown parameter [_type]\"},\"status\":400}"

this issue fix on fluentbit with adding suppress_Type_Name On
how to fix this on fluentd

[daipom]

@arafdy
https://www.elastic.co/guide/en/elasticsearch/reference/current/removal-of-types.html

It appears that Elasticsearch 8.0.0 or higher does not support mapping types.

I am not familiar with this.
Does https://github.com/uken/fluent-plugin-elasticsearch use this type feature by default?
If so, we would need a setting to disable this feature.

Have you tried this setting?

• suppress_type_name: https://github.com/uken/fluent-plugin-elasticsearch?tab=readme-ov-file#suppress_type_name