Debug the message "Rejecting mapping update..."

I am using a template index which has the following entry:

"index_patterns": "myindexpattern-*",

and also ...

  "mappings": {
    "_doc": {
      "dynamic" : "strict",
      "properties": {...

and also outputting some data to ES as follows:

  elasticsearch {
    hosts => ["my-es-host"]
    index => "myindexpattern-%{+YYYY.MM.dd}"
    template => "/usr/share/logstash/files/my_template.json"
    template_name => "my-template"
    manage_template => true
    template_overwrite => true

I am getting the following error:

logstash_1 | [2018-04-02T14:21:09,373][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"myindexpattern-500-2015.06.20", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x320a0860>], :response=>{"index"=>{"_index"=>"myindexpattern-500-2015.06.20", "_type"=>"doc", "_id"=>"IP67hmIBYgQuLfB3mDzK", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [some-name-500-2015.06.20] as the final mapping would have more than 1 type: [_doc, doc]"}}}}

How can I check what is the field causing the problem?

If you change _doc to doc does the problem go away? (You will need to delete the current day index before trying that.)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.