# Could not index event to elasticsearch not sure why

**URL:** <https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042>\
**Category:** Elasticsearch\
**Created:** [June 22, 2018, 2:39pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042 "2018-06-22T14:39:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulsaini](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@rahulsaini](https://discuss.elastic.co/u/rahulsaini)\
**Post date:** [June 22, 2018, 2:39pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042/1 "2018-06-22T14:39:44Z")

</div>

[2018-06-21T10:54:08,459][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2018-06-21T10:54:08,507][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2018-06-21T10:54:08,577][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[http://localhost:9200/](http://localhost:9200/)"]}  
[2018-06-21T10:54:08,692][INFO][logstash.inputs.http\_poller] Registering http\_poller Input {:type=\>nil, :schedule=\>{"cron"=\>"\*/2 \* \* \* \*"}, :timeout=\>nil}  
[2018-06-21T10:54:08,771][INFO][logstash.pipeline] Pipeline started succesfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x71b35d93 run\>"}  
[2018-06-21T10:54:08,955][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]}  
[2018-06-21T10:56:01,651][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"awscloudhealth", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x717005ba], :response=\>{"index"=\>{"\_index"=\>"awscloudhealth", "\_type"=\>"doc", "\_id"=\>"xODYImQBvS4rOSxdWow6", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [dimensions.time.label] of different type, current\_type , merged\_type [text]"}}}}

CONFIG FILE

input {  
http\_poller {  
urls =\> {  
ch\_costapi =\> {  
method =\> "GET"  
url =\> "xxxx"  
headers =\> {  
Accept =\> "application/json"  
}  
}  
}  
request\_timeout =\> 30  
schedule =\> { cron =\> "\*/2 \* \* \* \*"}  
codec =\> "json"  
}  
}  
filter {  
json\_encode {  
source =\> "message"  
}  
}  
filter  
{  
mutate {  
remove\_field =\> ["[time][label]" ]  
}  
}  
output {  
elasticsearch{   
hosts =\> [  
"[http://localhost:9200/](http://localhost:9200/)"  
]  
index =\> "awscloudhealth"  
cacert =\> "xxxx"  
}  
stdout {  
codec =\> rubydebug {  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![rahulsaini](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@rahulsaini](https://discuss.elastic.co/u/rahulsaini)\
**Post date:** [June 25, 2018, 5:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042/2 "2018-06-25T17:16:39Z")

</div>

anyone please help

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 25, 2018, 5:21pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042/3 "2018-06-25T17:21:16Z")

</div>

You probably have a better chance of getting help if you can show what the event looks like, e.g. by posting the output from the stdout plugin. Without that it is hard to tell.

---

<div class="post-metadata">

**Author:** ![rahulsaini](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@rahulsaini](https://discuss.elastic.co/u/rahulsaini)\
**Post date:** [June 25, 2018, 5:57pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042/4 "2018-06-25T17:57:12Z")

</div>

> [@rahulsaini](#):
>
> dimensions.time.label

I'm absolute beginner to this so I have no idea about that  
but what I have figured out so far is that my date field is date datatype and i am passing the text datatype.

I tried to mutate the field like this but it doesn't work

filter {  
mutate {  
remove\_field =\> ["dimensions.time.label"]  
}  
}

I think you must be referring about this

output {  
elasticsearch{   
hosts =\> ["[http://localhost:9200/](http://localhost:9200/)"]  
index =\> "awscloudhealth"  
}  
stdout {  
codec =\> rubydebug {}  
}  
}

Please let me know

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2018, 5:57pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-not-sure-why/137042/5 "2018-07-23T17:57:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.