Failed to map in indices
I have a configuration file and template file in logstash is as below please look into it
its done on fresh installation
1.Conf file
input {
file {
path => ["D:/JAEK/Results/Python/MyHVC/MyHVC_*.csv"]
type => "MSHEALTHCHK"
start_position => "beginning"
}
}
filter {
grok {
match => ["message" ,"%{DATA:ETime},%{NUMBER:OverAllStatus},%{DATA:Env},%{GREEDYDATA:Hostaddress},%{DATA:Port},%{GREEDYDATA:ServiceName},%{NUMBER:DiscoveryCompositeStatus},%{NUMBER:DiskSpaceStatus},%{NUMBER:BinderStatus},%{NUMBER:RefreshScopeStatus},%{NUMBER:ConfigServerStatus},%{NUMBER:HystrixStatus},%{NUMBER:RabbitStatus},%{NUMBER:DBStatus}"]
}
date {
timezone => "UTC"
match => ["ETime", "YYYY-MM-dd hh:mm:ss.SSSZ", "ISO8601"]
target => "ETime"
}
mutate {
#strip => ["message"]
convert =>{
"OverAllStatus" => "integer"
"DiscoveryCompositeStatus" => "integer"
"DiskSpaceStatus" => "integer"
"BinderStatus" => "integer"
"RefreshScopeStatus" => "integer"
"ConfigServerStatus" => "integer"
"HystrixStatus" => "integer"
"RabbitStatus" => "integer"
"DBStatus" => "integer"
}
}
}
output {
file {
path => "D:\MW\OutPutLogs\Whcr_logfile.txt"
}
elasticsearch {
hosts => "113.131.136.25:9200"
index => "mshealthchk-%{+YYYY.MM.dd}"
template_name => "mshealthchk*"
template => "D:\MW\logstash\templates\template_MyHvc.json"
template_overwrite => false
manage_template => true
}
}
2.Template File
{
"template" : "mshealthchk-*",
"settings" : {
"index.refresh_interval" : "10s"
},
"mappings" : {
"_doc": {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"type" : "keyword", "index" : "not_analyzed", "omit_norms" : true
},
"match_mapping_type" : "string" }
},
{
"integers": {
"match_mapping_type": "long",
"mapping": {
"type": "integer"
}
}
},
{
"string_fields" : {
"mapping" : {
"type" : "text", "index" : "analyzed", "norms": false,
"fields" : {
"keyword" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 1024}
}
},
"match_mapping_type" : "string",
"match" : "*"
}
}
],
"properties" : {
"@timestamp" : { "format" : "dateOptionalTime","type" : "date" },
"@version":{ "type": "keyword" },
"host": { "type": "keyword" },
"path": { "type": "keyword" },
"ETime": { "type": "date", "format" : "dateOptionalTime" },
"OverAllStatus": { "type": "integer" },
"Env": { "type": "keyword" },
"Hostaddress": { "type": "keyword" },
"Port": { "type": "keyword" },
"DiscoveryCompositeStatus": { "type": "integer" },
"DiskSpaceStatus": { "type": "integer" },
"BinderStatus": { "type": "integer" },
"RefreshScopeStatus": { "type": "integer" },
"ConfigServerStatus": { "type": "integer" },
"HystrixStatus": { "type": "integer" },
"RabbitStatus": { "type": "integer" },
"DBStatus": { "type": "integer" }
}
}
}
}
Provide logs (if relevant):
1. Elasticsearch Log:
[2018-03-21T04:07:57,372][DEBUG][o.e.a.b.TransportShardBulkAction] [mshealthchk-2018.03.21][3] failed to execute bulk item (index) BulkShardRequest [[mshealthchk-2018.03.21][3]] containing [index {[mshealthchk-2018.03.21][doc][H-Y-SGIBF0v4SOTxfGwf], source[{"@timestamp":"2018-03-21T11:07:53.613Z","path":"D:/JAEK/Results/Python/MyHVC/MyHVC_03212018.csv","DiscoveryCompositeStatus":1,"HystrixStatus":1,"RabbitStatus":1,"RefreshScopeStatus":1,"host":"feessw008","Hostaddress":"abc.com","DiskSpaceStatus":1,"type":"MSHEALTHCHK","OverAllStatus":1,"@version":"1","BinderStatus":1,"ServiceName":"ORDER SERVICE","message":"2018-03-21 07:06:23.355Z,1,qa1,abc.com,11051,ORDER SERVICE,1,1,1,1,1,1,1,1\r","Env":"qa1","ETime":"2018-03-21T07:06:23.355Z","DBStatus":1,"Port":"11051","ConfigServerStatus":1}]}] java.lang.IllegalArgumentException: Rejecting mapping update to [mshealthchk-2018.03.21] as the final mapping would have more than 1 type: [_doc, doc]
2. Logstash log:
[2018-03-21T04:07:57,379][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mshealthchk-2018.03.21", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x44a98c70>], :response=>{"index"=>{"_index"=>"mshealthchk-2018.03.21", "_type"=>"doc", "_id"=>"H-Y-SGIBF0v4SOTxfGwf", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [mshealthchk-2018.03.21] as the final mapping would have more than 1 type: [_doc, doc]"}}}}