# Cannot index event publisher.Event ... Root mapping definition has unsupported parameters: \[\_all : {norms=false}\]"}}

**URL:** <https://discuss.elastic.co/t/cannot-index-event-publisher-event-root-mapping-definition-has-unsupported-parameters-all-norms-false/190921>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 17, 2019, 8:31am UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-event-root-mapping-definition-has-unsupported-parameters-all-norms-false/190921 "2019-07-17T08:31:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leprovokateur](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\
**Post date:** [July 17, 2019, 8:31am UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-event-root-mapping-definition-has-unsupported-parameters-all-norms-false/190921/1 "2019-07-17T08:31:20Z")

</div>

Hi,

I try to use packetbeat, but receive the following error and no indices are created. What is the problem there?

> 2019-07-17T10:27:51.246+0200 WARN elasticsearch/client.go:527 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbf43d4e182e68b7b, ext:10354643272, loc:(\*time.Location)(0x2886540)}, Meta:common.MapStr(nil), Fields:common.MapStr{"agent":common.MapStr{"ephemeral\_id":"af96deb6-a59b-43bc-bbab-c9d7b4f2c961", "hostname":"q4deumsy0w2", "id":"5f92980f-152c-4e33-86b6-6e5fff1dfd22", "type":"packetbeat", "version":"7.2.0"}, "destination":common.MapStr{"ip":"192.168.123.255", "port":0x89}, "ecs":common.MapStr{"version":"1.0.0"}, "event":common.MapStr{"action":"network\_flow", "category":"network\_traffic", "dataset":"flow", "duration":762126511, "end":common.Time{wall:0x1a240650, ext:63698948869, loc:(\*time.Location)(nil)}, "kind":"event", "start":common.Time{wall:0x2851af9e, ext:63698948868, loc:(\*time.Location)(nil)}}, "flow":common.MapStr{"final":false, "id":"EAL/////AP////8I//8AAAHAqHoKwKh7/4kAiQA"}, "host":common.MapStr{"architecture":"x86\_64", "containerized":false, "hostname":"q4deumsy0w2", "id":"3499004948574b048702e521999c7fde", "name":"q4deumsy0w2", "os":common.MapStr{"codename":"Core", "family":"redhat", "kernel":"3.10.0-957.21.2.el7.x86\_64", "name":"CentOS Linux", "platform":"centos", "version":"7 (Core)"}}, "network":common.MapStr{"bytes":0x3ac, "community\_id":"1:UqHmJmaPmO6eLMmnnuoo97NzW+I=", "packets":0xa, "transport":"udp", "type":"ipv4"}, "source":common.MapStr{"bytes":0x3ac, "ip":"192.168.122.10", "packets":0xa, "port":0x89}, "type":"flow"}, Private:interface {}(nil), TimeSeries:false}, Flags:0x0} (status=400): {"type":"mapper\_parsing\_exception","reason":"Failed to parse mapping [_default_]: Root mapping definition has unsupported parameters: [\_all : {norms=false}]","caused\_by":{"type":"mapper\_parsing\_exception","reason":"Root mapping definition has unsupported parameters: [\_all : {norms=false}]"}}

Best regards,  
Robert

---

<div class="post-metadata">

**Author:** ![leprovokateur](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\
**Post date:** [July 17, 2019, 12:00pm UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-event-root-mapping-definition-has-unsupported-parameters-all-norms-false/190921/2 "2019-07-17T12:00:19Z")

</div>

This happens even with a freshly installed packetbeat without any changes to the configuration.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2019, 12:41pm UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-event-root-mapping-definition-has-unsupported-parameters-all-norms-false/190921/4 "2019-08-14T12:41:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.