# Can't write data to elasticsearch (cannot be changed from type \[date\] to \[text) **URL:** \ **Category:** Elasticsearch\ **Created:** [April 15, 2023, 9:08am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062 "2023-04-15T09:08:09Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 9:08am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/1 "2023-04-15T09:08:09Z")
Hi can't write data to elasticsearch vi logstash(http\_poller) here is the scenario: influxdb \> logstash(http\_poller) \> elasticsearch error that I get: > "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [results.series.values] cannot be changed from type [date] to [text]"}}} **logstash config:** > input { > http\_poller { > urls =\> { > test1 =\> { > method =\> get > url =\> "[http://192.168.1.1:8086/query?pretty=true&q=SELECT+\*+FROM+cpu%20WHERE%20time%20\>%20now()%20-%201m&db=monitorindb](http://192.168.1.1:8086/query?pretty=true&q=SELECT+*+FROM+cpu%20WHERE%20time%20%3E%20now()%20-%201m&db=monitorindb)" > headers =\> { > Authorization =\> "Token " > } > } > } > schedule =\> { cron =\> "\* \* \* \* \* UTC"} > request\_timeout =\> 60 > codec =\> "json" > metadata\_target =\> "http\_poller\_metadata" > > } > } > > output { > elasticsearch { > hosts =\> "localhost:9200" > index =\> "http\_poller" > user =\> "elastic" > password =\> "PASS" > > } > } ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 15, 2023, 9:28am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/2 "2023-04-15T09:28:17Z")
Check your mapping and or your data. `results.series.values` can not be parsed as a `date`. ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 9:30am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/3 "2023-04-15T09:30:49Z")
@dadoonet where should i check it? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 15, 2023, 9:49am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/4 "2023-04-15T09:49:03Z")
I believe I wrote this: > Check your mapping So I'd do something like: ```auto GET /http_poller/_mapping ``` ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 10:01am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/5 "2023-04-15T10:01:53Z")
@dadoonet return below result, what should i do next? GET /http\_poller/\_mapping { "http\_poller": { "mappings": {} } } ![http_poller](https://us1.discourse-cdn.com/elastic/original/3X/1/6/166ac7ae11a50675a83be467b482646541600a0d.png) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 15, 2023, 11:10am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/6 "2023-04-15T11:10:25Z")
I'm surprised by the mapping... It's not aligned with the error message. So I believe you did something in the middle, like removing the index.... ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 11:13am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/7 "2023-04-15T11:13:34Z")
@dadoonet yes i did that, because add this for test: filter { mutate { remove\_field =\> ["date"] } } for sure remove index, and it will recreated automatically but issue still remain. Any idea? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2023, 11:14am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/8 "2023-04-15T11:14:58Z")
If that is the format you are trying to index you will have problems. All values in the `values` array need to have the same mapping. If you are using dynamic mapping the first value envountered will define the mapping type. If you have a mixed array like you do it is possible indexing the document on its own fails due to mapping conflict so that nothing gets inserted. I believe you will need to restructure the document into something that is actually usable in Elasticsearch. ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 11:18am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/9 "2023-04-15T11:18:19Z")
@Christian_Dahlqvist someone do this, > [@InfluxDB input plugin for logstash](https://discuss.elastic.co/t/influxdb-input-plugin-for-logstash/107670/2): > > I have got some other approach for connecting to influxDB as an input plugin : input { http\_poller { urls =\> { cpu =\> { user =\> "\*\*\*\*\*" password =\> "\*\*\*\*\*" url =\> "http://localhost:8086/query?pretty=true&db=inspectit&q=SELECT+\*+FROM+cpu" headers =\> { Accept =\> "application/json } } } } } filter { split { field =\> "results" } split { field =\> "[results][series]" } split { field =\> "[results][series][values]… ```auto filter { split { field => "results" } split { field => "[results][series]" } split { field => "[results][series][values]" } if[name]== "cpu" { ruby { #event.set(event.get("[results][series][columns][0]"),event.get("[results][series][values][0])") code => ' event.set(event.get("[results][series][columns][0]"),event.get("[results][series][values][0]")) ' } } ``` any idea? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2023, 11:20am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/10 "2023-04-15T11:20:41Z")
No, I have no idea. Have never pulled data from InfluxDB. It may help if you show a sample document you are trying to index. ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 11:47am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/11 "2023-04-15T11:47:48Z")
after several try and error finally fix with this: ```auto DELETE /http_poller PUT /http_poller { "mappings": { "properties": { "results": { "type": "nested", "properties": { "series": { "type": "nested", "properties": { "values": { "type": "text" } } } } } } } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2023, 1:05pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/12 "2023-04-15T13:05:31Z")
You may want to map it as `keyword` instead of `text` and that will not analyse it. If you are indexing it exactly as shown in the screenshot above I think you will have issues querying it, so I would recommend restructuring the document if that is the case so that it contains key-value pairs with the data instead of separate arrays of keys and values. ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 15, 2023, 1:05pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/13 "2023-04-15T13:05:40Z")
@Christian_Dahlqvist here is the json file: > ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 15, 2023, 1:09pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/14 "2023-04-15T13:09:37Z")
You may be able to index that document into Elasticsearch but I do not see how you will be able to use it for anything useful in that format. I would split this large document into multiple documents and transform the data arrays to neat key-value pairs. That would allow you to search and use the data in Kibana, which the current structure will not. You may also want to assign an ID to reduce the risk of duplicates, but that depends on the data the http poller will be returning. ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 16, 2023, 4:56am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/15 "2023-04-16T04:56:55Z")
@Christian_Dahlqvist would you please give me a sample config to extract key/values from json that i post? e.g: extract key/values from this part: time,cpu,host,usage\_guest ```auto "series": [ "columns": [ "time", "cpu", "host", "usage_guest", "values": [ "2023-04-15T12:13:00Z", "cpu1", "server1", "0", ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 16, 2023, 11:52am UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/16 "2023-04-16T11:52:09Z")
Try something like this: ```auto filter { split { field => "results" } split { field => "[results][series]" } split { field => "[results][series][values]" } mutate { rename => { "[results][series]" => "series" } } mutate { rename => { "[series][name]" => "name" } } ruby { code => 'series = event.get("series"); series["columns"].each_with_index {|val, index| event.set(val, event.get("[series][values][" + index.to_s() + "]"))}' } prune { blacklist_names => ["event", "host", "series"] } } ``` ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 16, 2023, 4:59pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/17 "2023-04-16T16:59:11Z")
Why you put these on blacklist? These keywords use by elastic? "event", "host", "series" ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 16, 2023, 5:39pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/18 "2023-04-16T17:39:02Z")
It removes those fields from the event. You can keep them if you want to... ---
**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Post date:** [April 16, 2023, 6:03pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/19 "2023-04-16T18:03:32Z")
@Christian_Dahlqvist I mean these are reserved for elsticsearch? Or just put it for example? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 16, 2023, 6:22pm UTC](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062/20 "2023-04-16T18:22:49Z")
The `event` field field contains the original event string, which I think is no longer needed. The `series` field contains the raw arrays that have been parsed out, so is in my opinion no longer needed either. The `host` filed might possibly be useful, so keep that if you need it. Deleting these fields just cleans up the event. [Next page](https://discuss.elastic.co/t/cant-write-data-to-elasticsearch-cannot-be-changed-from-type-date-to-text/330062.md?page=2)