# \[6.0.0alpha\] Packetbeat - multiple types
**URL:** https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220
**Category:** Beats
**Tags:** packetbeat
**Created:** [May 26, 2017, 8:46am UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220 "2017-05-26T08:46:49Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Oozza](https://discuss.elastic.co/u/Oozza)
#### Post date: [May 26, 2017, 8:46am UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/1 "2017-05-26T08:46:49Z")
While running fresh Elastic stack version 6.0.0 alpha, most Packetbeat events cannot be indexed.
I have loaded Packetbeat template into Elasticsearch before running Logstash and Packetbeat. Logstash only indexes events with one type and reports error when trying to index different type.
By default Elasticsearch 6.0.0 forces single type indices, while Packetbeat is using multiple types (http,icmp,flow).
Adding `index.mapping.single_type : false` to the index template fixes the problem.
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [May 29, 2017, 7:43am UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/2 "2017-05-29T07:43:46Z")
Hi, just for clarity, you tested Packetbeat 6.0.0-alpha1 with ES 6.0.0-alpha1? I'd expect this to work, but Packetbeat 5.x with ES 6.0.0-alpha1 indeed doesn't work without that change. We are planning to have Packetbeat 5.5 work with ES 6.0 without any workarounds.
---
### Author:  [@Oozza](https://discuss.elastic.co/u/Oozza)
#### Post date: [May 29, 2017, 10:05am UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/3 "2017-05-29T10:05:39Z")
Hi, Tudor,
I have tested versions 6.0.0-alpha1 of all components, including Packetbeat.
To clarify it more: Packetbeat -\> ES works. The "\_type" is always "doc", which means it's single type.
Packetbeat -\> Logstash -\> ES does not work. Packetbeat also sends field named "type" that is automatically copied into field "\_type" by Logstash. This is probably the cause.
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [May 29, 2017, 11:08am UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/4 "2017-05-29T11:08:11Z")
Ah, gotcha. Which Logstash config did you use? We've recently updated our [docs](https://www.elastic.co/guide/en/beats/filebeat/master/logstash-output.html) to not set a type explicitly.
---
### Author:  [@Oozza](https://discuss.elastic.co/u/Oozza)
#### Post date: [May 29, 2017, 1:10pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/5 "2017-05-29T13:10:15Z")
The logstash's pipeline config was:
```
input {
beats {
port => "5044"
}
}
filter {
}
output {
elasticsearch {
index => "packetbeat-6.0.0-alpha1-%{+YYYY.MM.dd}"
}
}
```
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [May 29, 2017, 2:10pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/6 "2017-05-29T14:10:16Z")
Interesting, I don't seem to be able to reproduce that when using the master version. The `type` differs per document, but `_type` is always set to `doc` and Logstash doesn't seem to change it.
---
### Author:  [@Oozza](https://discuss.elastic.co/u/Oozza)
#### Post date: [May 29, 2017, 2:24pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/7 "2017-05-29T14:24:28Z")
May be changed between versions we are using. I am using version 6.0.0-alpha1 available for download on [elastic.co](http://elastic.co) (release date May 09). Just tried it again, deleting ES directory and extracting new one. I can now link the warning from Logstash. If it's working on master version I believe it was fixed and we can close this.
```
[2017-05-29T16:18:14,245][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400,
:action=>["index", {:_id=>nil, :_index=>"packetbeat-6.0.0-alpha1-2017.05.29", :_type=>"http", :_routing=>nil}, 2017-05-2
9T14:18:12.702Z MyPC %{message}], :response=>{"index"=>{"_index"=>"packetbeat-6.0.0-alpha1-2017.05.29", "_type"=>
"http", "_id"=>"AVxUklE_UDJvpVdzoTzC", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecti
ng mapping update to [packetbeat-6.0.0-alpha1-2017.05.29] as the final mapping would have more than 1 type: [doc, http]"
}}}}
```
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [May 29, 2017, 3:14pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/8 "2017-05-29T15:14:52Z")
Yeah, i also suspect it was fixed in the meantime. We're going to release alpha2 relatively soon. Thanks for researching this!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2017, 3:15pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220/9 "2017-06-26T15:15:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.