Debug the message "Rejecting mapping update..."

Elastic Stack Elasticsearch
1

I am using a template index which has the following entry:

"index_patterns": "myindexpattern-*",

and also ...

  "mappings": {
    "_doc": {
      "dynamic" : "strict",
      "properties": {...

and also outputting some data to ES as follows:

  elasticsearch {
    hosts => ["my-es-host"]
    index => "myindexpattern-%{+YYYY.MM.dd}"
    template => "/usr/share/logstash/files/my_template.json"
    template_name => "my-template"
    manage_template => true
    template_overwrite => true
  }

I am getting the following error:

logstash_1 | [2018-04-02T14:21:09,373][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"myindexpattern-500-2015.06.20", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x320a0860>], :response=>{"index"=>{"_index"=>"myindexpattern-500-2015.06.20", "_type"=>"doc", "_id"=>"IP67hmIBYgQuLfB3mDzK", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [some-name-500-2015.06.20] as the final mapping would have more than 1 type: [_doc, doc]"}}}}

How can I check what is the field causing the problem?

2

If you change _doc to doc does the problem go away? (You will need to delete the current day index before trying that.)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.