# Could not index event to Elasticsearch.Rejecting mapping update to \[\] as the final mapping would have more than 1 type: \[\_doc,syslog\]
**URL:** https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326
**Category:** Logstash
**Created:** [June 23, 2020, 7:22pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326 "2020-06-23T19:22:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@cezar996](https://discuss.elastic.co/u/cezar996)
#### Post date: [June 23, 2020, 7:22pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326/1 "2020-06-23T19:22:09Z")
Hello everybody!
I get the following error when I try to send syslog data to Elasticsearch Index:
`[logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"arcsight-2020.06.11", :_type=>"syslog", :_routing=>nil}, #LogStash::Event:0x262ee34b], :response=>{"index"=>{"_index"=>"arcsight-2020.06.11", "_type"=>"syslog", "_id"=>"uv2dnWEBlrOJlly6qpiU", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [arcsight-2020.06.11] as the final mapping would have more than 1 type: [_doc,syslog]`
I also want to mention that I get the following warning:
`[WARN][logstash.outputs.elasticsearch] You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0.`
I dont know if this is the cause of the first error, but I guess that these two things are related. I use ELK 7.6.2.
If somebody has any ideas, please help me to solve this problem! Thanks in advance!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 23, 2020, 7:51pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326/2 "2020-06-23T19:51:51Z")
> [@cezar996](#):
>
> If somebody has any ideas, please help me to solve this problem!
Remove the document\_type option from the elasticsearch output.
---
### Author:  [@cezar996](https://discuss.elastic.co/u/cezar996)
#### Post date: [June 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326/3 "2020-06-24T15:44:52Z")
Hi @Badger and thank you very much for your reply!
This topic is related to my post [discuss.elastic.co](https://discuss.elastic.co/t/how-to-integrate-elk-with-arcsight/236762) for which I have found the solution that implicitly solved this problem I posted here. 😀
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2020, 3:55pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326/4 "2020-07-22T15:55:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.