# Dynamic Mapping Watcher

**URL:** <https://discuss.elastic.co/t/dynamic-mapping-watcher/2091>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 7, 2015, 4:27pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091 "2015-06-07T16:27:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterColclough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petercolclough/32/44777_2.png) [@peterColclough](https://discuss.elastic.co/u/peterColclough)\
**Post date:** [June 7, 2015, 4:27pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/1 "2015-06-07T16:27:56Z")

</div>

Oh dear... well here we go. Tried with the example log watcher, and with creating the watch I get this:

{"error":"WatcherException[failed to put watch [log\_error\_watch]]; nested: TypeMissingException[[.watches] type[[watch, trying to auto create mapping, but dynamic mapping is disabled]] missing]; ","status":500}

I have other indexes on the cluster that are working fine.. and have been for 10+ months, so what have I missed here? Do I actually have to create a mapping for watcher? If so, what fields are returned as normal?

My curl call was:  
curl -XPUT 'http://[myserver]:[myport]/\_watcher/watch/log\_error\_watch' -d '{  
"trigger" : {  
"schedule" : { "interval" : "10s" }  
},  
"input" : {  
"search" : {  
"request" : {  
"indices" : ["logs"],  
"body" : {  
"query" : {  
"match" : { "message": "error" }  
}  
}  
}  
}  
}  
}'

Thanks in advance....

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 8, 2015, 12:58am UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/2 "2015-06-08T00:58:02Z")

</div>

What index are you putting this against, because it looks like that dynamic mapping explicitly disabled.

---

<div class="post-metadata">

**Author:** ![peterColclough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petercolclough/32/44777_2.png) [@peterColclough](https://discuss.elastic.co/u/peterColclough)\
**Post date:** [June 8, 2015, 7:47am UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/3 "2015-06-08T07:47:50Z")

</div>

Apologies... forgot the correct curl call.. its against the \_watcher index:

curl -XPUT 'http://[my\_server]:[my\_port]/\_watcher/watch/log\_error\_watch' -d '{  
"trigger" : {  
"schedule" : { "interval" : "10s" }  
},  
"input" : {  
"search" : {  
"request" : {  
"indices" : ["logs"],  
"body" : {  
"query" : {  
"match" : { "message": "error" }  
}  
}  
}  
}  
}  
}'

What would cause the dynamic mapping to be turned off? I haven't (knowingly) turned it off...as its really useful to have turned on.

Peter C

---

<div class="post-metadata">

**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\
**Post date:** [June 8, 2015, 12:16pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/4 "2015-06-08T12:16:52Z")

</div>

Hi Peter,

can you provide us the output for:

```
GET .watches/_mapping

```

Is there a chance you accidentally deleted the mappings for the `.watches` index?

---

<div class="post-metadata">

**Author:** ![peterColclough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petercolclough/32/44777_2.png) [@peterColclough](https://discuss.elastic.co/u/peterColclough)\
**Post date:** [June 8, 2015, 12:20pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/5 "2015-06-08T12:20:35Z")

</div>

> [@uboness](#):
>
> GET .watches/\_mapping

Ooops....you just cant get the staff can you:  
{  
".watches" : {  
"mappings" : { }  
}  
}

That doesn't look good does it? Is there an easy way to get them back?  
Peter C

---

<div class="post-metadata">

**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\
**Post date:** [June 8, 2015, 12:57pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/6 "2015-06-08T12:57:23Z")

</div>

> That doesn't look good does it?

no, it doesn't :).

yea.. seems like the mappings were deleted, do the following:

1. stop the node
2. add `watcher.index.rest.direct_access: true` to `elasticsearc.yml`
3. start the node
4. delete `.watches` index `DELETE /.watches`

now you should be able the put watches again. But before you do that, please revert the direct access setting:

1. stop the node
2. remove `watcher.index.rest.direct_access: true` from `elasticsearch.yml`
3. start the node

The `watcher.index.rest.direct_access` enables/disables direct access to the `.watches` index via the rest API such that you won't be able to add/delete/update documents there. We don't have this protection (yet) against mapping deletion.... we'll consider adding it (or find another way to prevent this from happening)

pls let us know how it goes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/dynamic-mapping-watcher/2091/7 "2017-07-06T13:49:39Z")

</div>