# Dataframe Analytics Job Failed to apply boolean mapping

**URL:** <https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 13, 2020, 7:53am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383 "2020-05-13T07:53:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 13, 2020, 7:53am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383/1 "2020-05-13T07:53:02Z")

</div>

Hello,

Just tried a dataframe analytics outlier job on our panw data, which immeditaly failed when trying to start:

An error occurred starting the data frame analytics dig\_dfa\_outlier\_panw\_user\_001: {"statusCode":400,"error":"Bad Request","message":"[illegal\_argument\_exception] cannot apply boolean mapping to field [coredns.dnssec\_ok]"}

coredns.dnssec\_ok isn't even a field in these indices. It's inherited by the filebeat template..

Excluding it just throws an error on an other unused boolean field.

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![wei.wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wei.wang/32/51803_2.png) [@wei.wang](https://discuss.elastic.co/u/wei.wang)\
**Post date:** [May 14, 2020, 3:52am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383/2 "2020-05-14T03:52:22Z")

</div>

Hi Willem,

First, could you tell which stack version you are using?

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 14, 2020, 6:19am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383/3 "2020-05-14T06:19:42Z")

</div>

Hey Wei, Current version is 7.6.1. Grtz

---

<div class="post-metadata">

**Author:** ![wei.wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wei.wang/32/51803_2.png) [@wei.wang](https://discuss.elastic.co/u/wei.wang)\
**Post date:** [May 15, 2020, 3:48am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383/4 "2020-05-15T03:48:32Z")

</div>

Hi Willem,

In v7.6.1, if, as you described, `coredns.dnssec_ok` isn't even a field in these indices, a different error should be thrown:

> **An error occurred starting the data frame analytics job:**
> 
> [status\_exception] Unable to start \< dig\_dfa\_outlier\_panw\_user\_001 \> as no documents in the source indices \< your source index\> contained all the fields selected for analysis. ...

What I am going to suggest:

1. Double check all the indices which you are using as outlier job's source index, and see if any doc has value for `coredns.dnssec_ok`,
2. Then check if there are any mapping differences across all the indices for field `coredns.dnssec_ok`,
3. Better to avoid using an existing index as destination index,
4. Instead of excluding fields, you can choose which fields to be included, here it is the example : [Create data frame analytics jobs API | Elasticsearch Guide [master] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/put-dfanalytics.html#CO595-5)

If all the above still cant fix your problem, I might need more information fo troubleshooting, like your source indices mapping, job settings json, etc.

Regards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2020, 3:48am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383/5 "2020-06-12T03:48:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.