# Can't index new docs due to type error; sending to old indices still works

**URL:** https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628
**Category:** Elasticsearch
**Created:** [September 17, 2022, 10:45pm UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628 "2022-09-17T22:45:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![emw](https://avatars.discourse-cdn.com/v4/letter/e/e99b99/32.png) [@emw](https://discuss.elastic.co/u/emw)
#### Post date: [September 17, 2022, 10:45pm UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628/1 "2022-09-17T22:45:00Z")

</div>

In my ES 7.17 cluster, I'm using index templates to create a new weekly index where I send log data. The index names are generated by my application, not by ES; the template handles index patterns, field limits, and aliases.

I modified the template to decrease the number of shards I was creating for each index, and I must have unknowingly made some other change to the index template, because new indices are now rejecting documents with this error:

> {"took":2,"ingest\_took":0,"errors":true,"items":[{"index":{"\_index":"nlog-2022.38\_le","\_type":"logevent","\_id":"HbAuTYMBsEj06M5VHS-G","status":400,"error":{"type":"illegal\_argument\_exception","reason":"Invalid type: expecting [\_doc] but got [logevent]"}}},{"index":{"\_index":"nlog-2022.38\_le","\_type":"logevent","\_id":"HrAuTYMBsEj06M5VHS-G","status":400,"error":{"type":"illegal\_argument\_exception","reason":"Invalid type: expecting [\_doc] but got [logevent]"}}}]}

The key part apparently being **Invalid type: expecting [\_doc] but got [logevent]".**  
The documents look like:

> {"index":{"\_index":"nlog-2022.38","\_type":"logevent","pipeline":"MainIngestionPipeline"}}  
> {"@timestamp":"2022-09-17T22:06:36.4183000","level":"Info","message":"2022-09-17 15:06:36.4183|INFO|StartupLogger|Initializing User Interface","MachineName":"BSN0000","Application":"MainUI","LogLevel":"INFO","Source":"StartupLogger","Callsite":"StacktraceHere","LogMessage":"Initializing User Interface","ElapsedMs":7707}

I realize that format looks a little weird, but I'm having trouble capturing exactly what NLog, my logging library, is spitting out. This has all been working for a long time: the data being sent and the pipeline (which appends \_le to the index name, for logevent) have not changed, and the only change I know I made lately is to the index template. I can send other, simpler documents to the new index without issue.

Additionally, if I send this type of entry to a previous week's index, it still gets indexed correctly, leading me to believe there's something in my new index settings that is wrong. I can read the error and see that it has something to do with being a logevent instead of a \_doc, but then why does it still work, in other indices? If I  
`GET /nlog-2022.38_le/_settings` it looks exactly like the previous week's settings.

What other settings should I be looking at to determine what's wrong, or what else could be happening here? The cluster is otherwise healthy. Any help or suggestions are much appreciated.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 17, 2022, 11:34pm UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628/2 "2022-09-17T23:34:46Z")

</div>

Hi @emw Welcome to the community!

> [@emw](#):
>
> ,"\_type":"logevent"

Setting `_type` to anything other than `_doc` was removed in 7.x

That was allowed in earlier versions 6.xm before.

You should read this

> **[Removal of mapping types | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/removal-of-types.html)**

---

<div class="post-metadata">

### Author: ![emw](https://avatars.discourse-cdn.com/v4/letter/e/e99b99/32.png) [@emw](https://discuss.elastic.co/u/emw)
#### Post date: [September 18, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628/3 "2022-09-18T00:23:13Z")

</div>

Interesting - I upgraded from 6.8 to 7.17 a few months ago but haven't had any problems until just now.

And you're right, as long as leave the \_type as \_doc, it seems to work just fine. I guess I can update my main ingestion pipeline to change everything to be a \_doc instead of a logevent. That will have some consequences for me, but it's probably the best solution to my problem.

Still, I wonder why I only noticed a problem now instead of back when I did that upgrade? But either way, thanks for the help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 16, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628/4 "2022-10-16T00:23:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
