Could some one help me

Elastic Stack Elasticsearch
1

I'm trying to PUT a cloudlfare template on to a ELK 7.5 and its failing to create a template.

Below is the error
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [doc : {properties={WAFRuleID={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ZoneID={type=long}, OriginResponseTime={type=long}, OriginResponseHTTPExpires={fields={keyword={ignore_above=256, type=keyword}}, type=text}, RayID={type=keyword}, SecurityLevel={type=keyword}, EdgeResponseCompressionRatio={type=float}, EdgeColoID={type=long}, ClientRequestProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientSrcPort={type=long}, EdgeResponseStatus={type=long}, OriginResponseBytes={type=long}, OriginResponseHTTPLastModified={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientSSLProtocol={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgePathingOp={type=keyword}, ClientIP={properties={timezone={type=keyword}, ip={type=keyword}, latitude={type=float}, continent_code={type=keyword}, city_name={type=keyword}, dma_code={type=long}, country_code2={type=keyword}, country_name={type=keyword}, country_code3={type=keyword}, location={type=geo_point}, region_name={fields={keyword={ignore_above=256, type=keyword}}, type=text}, postal_code={type=keyword}, longitude={type=float}, region_code={type=keyword}}}, CacheTieredFill={type=boolean}, ClientSSLCipher={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ParentRayID={type=keyword}, EdgeRequestHost={type=keyword}, ClientRequestUserAgent={fields={keyword={ignore_above=512, type=keyword}}, type=text}, EdgePathingSrc={type=keyword}, EdgeRateLimitID={type=long}, ClientDeviceType={type=keyword}, ClientIPClass={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerSubrequestCount={type=long}, OriginSSLProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFMatchedVar={type=text, fields={keyword={ignore_above=256, type=keyword}}}, EdgeRateLimitAction={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgeResponseBytes={type=long}, ClientRequestURI={type=text, fields={keyword={ignore_above=512, type=keyword}}}, WorkerSubrequest={type=boolean}, EdgeStartTimestamp={type=date}, WAFFlags={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestHost={type=keyword}, WorkerStatus={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientRequestPath={type=text, fields={keyword={ignore_above=256, type=keyword}}}, UserAgent={properties={patch={type=keyword}, minor={type=keyword}, major={type=keyword}, os={type=text, fields={keyword={ignore_above=256, type=keyword}}}, build={type=keyword}, os_minor={type=keyword}, os_major={type=keyword}, name={type=keyword}, os_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, device={type=keyword}}}, @version={type=keyword}, OriginResponseStatus={type=long}, CacheCacheStatus={type=keyword}, OriginIP={type=keyword}, ClientASN={type=long}, WAFProfile={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFAction={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientCountry={type=keyword}, ClientRequestReferer={fields={keyword={ignore_above=512, type=keyword}}, type=text}, message={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestBytes={type=long}, WAFRuleMessage={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerCPUTime={type=long}, EdgeResponseContentType={fields={keyword={ignore_above=256, type=keyword}}, type=text}, @timestamp={type=date}, EdgeServerIP={type=keyword}, EdgePathingStatus={type=keyword}, CacheResponseBytes={type=long}, ClientRequestMethod={type=keyword}, EdgeEndTimestamp={type=date}, CacheResponseStatus={type=long}}}]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [doc : {properties={WAFRuleID={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ZoneID={type=long}, OriginResponseTime={type=long}, OriginResponseHTTPExpires={fields={keyword={ignore_above=256, type=keyword}}, type=text}, RayID={type=keyword}, SecurityLevel={type=keyword}, EdgeResponseCompressionRatio={type=float}, EdgeColoID={type=long}, ClientRequestProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientSrcPort={type=long}, EdgeResponseStatus={type=long}, OriginResponseBytes={type=long}, OriginResponseHTTPLastModified={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientSSLProtocol={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgePathingOp={type=keyword}, ClientIP={properties={timezone={type=keyword}, ip={type=keyword}, latitude={type=float}, continent_code={type=keyword}, city_name={type=keyword}, dma_code={type=long}, country_code2={type=keyword}, country_name={type=keyword}, country_code3={type=keyword}, location={type=geo_point}, region_name={fields={keyword={ignore_above=256, type=keyword}}, type=text}, postal_code={type=keyword}, longitude={type=float}, region_code={type=keyword}}}, CacheTieredFill={type=boolean}, ClientSSLCipher={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ParentRayID={type=keyword}, EdgeRequestHost={type=keyword}, ClientRequestUserAgent={fields={keyword={ignore_above=512, type=keyword}}, type=text}, EdgePathingSrc={type=keyword}, EdgeRateLimitID={type=long}, ClientDeviceType={type=keyword}, ClientIPClass={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerSubrequestCount={type=long}, OriginSSLProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFMatchedVar={type=text, fields={keyword={ignore_above=256, type=keyword}}}, EdgeRateLimitAction={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgeResponseBytes={type=long}, ClientRequestURI={type=text, fields={keyword={ignore_above=512, type=keyword}}}, WorkerSubrequest={type=boolean}, EdgeStartTimestamp={type=date}, WAFFlags={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestHost={type=keyword}, WorkerStatus={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientRequestPath={type=text, fields={keyword={ignore_above=256, type=keyword}}}, UserAgent={properties={patch={type=keyword}, minor={type=keyword}, major={type=keyword}, os={type=text, fields={keyword={ignore_above=256, type=keyword}}}, build={type=keyword}, os_minor={type=keyword}, os_major={type=keyword}, name={type=keyword}, os_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, device={type=keyword}}}, @version={type=keyword}, OriginResponseStatus={type=long}, CacheCacheStatus={type=keyword}, OriginIP={type=keyword}, ClientASN={type=long}, WAFProfile={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFAction={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientCountry={type=keyword}, ClientRequestReferer={fields={keyword={ignore_above=512, type=keyword}}, type=text}, message={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestBytes={type=long}, WAFRuleMessage={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerCPUTime={type=long}, EdgeResponseContentType={fields={keyword={ignore_above=256, type=keyword}}, type=text}, @timestamp={type=date}, EdgeServerIP={type=keyword}, EdgePathingStatus={type=keyword}, CacheResponseBytes={type=long}, ClientRequestMethod={type=keyword}, EdgeEndTimestamp={type=date}, CacheResponseStatus={type=long}}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [doc : {properties={WAFRuleID={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ZoneID={type=long}, OriginResponseTime={type=long}, OriginResponseHTTPExpires={fields={keyword={ignore_above=256, type=keyword}}, type=text}, RayID={type=keyword}, SecurityLevel={type=keyword}, EdgeResponseCompressionRatio={type=float}, EdgeColoID={type=long}, ClientRequestProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientSrcPort={type=long}, EdgeResponseStatus={type=long}, OriginResponseBytes={type=long}, OriginResponseHTTPLastModified={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientSSLProtocol={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgePathingOp={type=keyword}, ClientIP={properties={timezone={type=keyword}, ip={type=keyword}, latitude={type=float}, continent_code={type=keyword}, city_name={type=keyword}, dma_code={type=long}, country_code2={type=keyword}, country_name={type=keyword}, country_code3={type=keyword}, location={type=geo_point}, region_name={fields={keyword={ignore_above=256, type=keyword}}, type=text}, postal_code={type=keyword}, longitude={type=float}, region_code={type=keyword}}}, CacheTieredFill={type=boolean}, ClientSSLCipher={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ParentRayID={type=keyword}, EdgeRequestHost={type=keyword}, ClientRequestUserAgent={fields={keyword={ignore_above=512, type=keyword}}, type=text}, EdgePathingSrc={type=keyword}, EdgeRateLimitID={type=long}, ClientDeviceType={type=keyword}, ClientIPClass={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerSubrequestCount={type=long}, OriginSSLProtocol={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFMatchedVar={type=text, fields={keyword={ignore_above=256, type=keyword}}}, EdgeRateLimitAction={fields={keyword={ignore_above=256, type=keyword}}, type=text}, EdgeResponseBytes={type=long}, ClientRequestURI={type=text, fields={keyword={ignore_above=512, type=keyword}}}, WorkerSubrequest={type=boolean}, EdgeStartTimestamp={type=date}, WAFFlags={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestHost={type=keyword}, WorkerStatus={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientRequestPath={type=text, fields={keyword={ignore_above=256, type=keyword}}}, UserAgent={properties={patch={type=keyword}, minor={type=keyword}, major={type=keyword}, os={type=text, fields={keyword={ignore_above=256, type=keyword}}}, build={type=keyword}, os_minor={type=keyword}, os_major={type=keyword}, name={type=keyword}, os_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, device={type=keyword}}}, @version={type=keyword}, OriginResponseStatus={type=long}, CacheCacheStatus={type=keyword}, OriginIP={type=keyword}, ClientASN={type=long}, WAFProfile={type=text, fields={keyword={ignore_above=256, type=keyword}}}, WAFAction={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ClientCountry={type=keyword}, ClientRequestReferer={fields={keyword={ignore_above=512, type=keyword}}, type=text}, message={fields={keyword={ignore_above=256, type=keyword}}, type=text}, ClientRequestBytes={type=long}, WAFRuleMessage={fields={keyword={ignore_above=256, type=keyword}}, type=text}, WorkerCPUTime={type=long}, EdgeResponseContentType={fields={keyword={ignore_above=256, type=keyword}}, type=text}, @timestamp={type=date}, EdgeServerIP={type=keyword}, EdgePathingStatus={type=keyword}, CacheResponseBytes={type=long}, ClientRequestMethod={type=keyword}, EdgeEndTimestamp={type=date}, CacheResponseStatus={type=long}}}]"
}
},
"status": 400
}

2

Hi @pmohan, Could u parse the original template here to let us try it out for your case?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.