# Elasticsearch 6.0 multiple types problem

**URL:** <https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928>\
**Category:** Elasticsearch\
**Created:** [November 23, 2017, 5:09pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928 "2017-11-23T17:09:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mati](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@mati](https://discuss.elastic.co/u/mati)\
**Post date:** [November 23, 2017, 5:09pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928/1 "2017-11-23T17:09:12Z")

</div>

Hi everyone,  
I wanna ask about help with sending logs to Elasticsearch.  
I use kv filter to parse logs from Fortigate devices.  
One of logged fields is named type which is automaticaly parsed to meta field \_type.  
Since Elasticsearch removed support multiple types in new indexes I can't log from Fortigate.  
I get an error:  
`Rejecting mapping update to [fg-2017.11.23] as the final mapping would have more than 1 type: [utm, traffic]`

I tried to modify \_type filed in logstash before sending to Elasticseach like below but no luck.

```
input {
       udp {
            port => 3341
            add_field => { "log_source" => "fortigate" }
    }
}
filter {
     if [log_source] == "fortigate" {
              kv {}
              mutate { copy => { "index_type" => "logtype" } }
              mutate { remove_field => ["index_type"] }
     }
 }
 output {
    if [log_source] == "fortigate" {
      elasticsearch {
         hosts => ["localhost:9200"]
         index => 'fg-%{+YYYY.MM.dd}'
      }
    } 
 }     

```

How to fix this problem?

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [November 23, 2017, 5:42pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928/2 "2017-11-23T17:42:14Z")

</div>

Check out [this upgrading advice](https://www.elastic.co/guide/en/logstash/6.0/upgrading-logstash-6.0.html) or [this sticky in the Logstash subforum](https://discuss.elastic.co/t/attention-logstash-6-0-0-known-issue-indexing-to-elasticsearch-6-0/108789).

What you need to do is explicitly set `document_type` in the `elasticsearch` output, like this:

```
elasticsearch {
  hosts => ["localhost:9200"]
  index => 'fg-%{+YYYY.MM.dd}'
  document_type => doc
}

```

This may not work for any existing indexes, as there will already be a type defined in the mapping of those indexes, but it will work for all new indexes.

---

<div class="post-metadata">

**Author:** ![mati](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@mati](https://discuss.elastic.co/u/mati)\
**Post date:** [November 23, 2017, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928/3 "2017-11-23T18:03:46Z")

</div>

Hi Abdon,  
When I added `document_type` in elasticsearch it works!  
I had already mapping template for that index so I had to set `document_type => fortigate` where fortigate is template's type name.

Thank's for help,  
Regards!

---

<div class="post-metadata">

**Author:** ![AshishC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishc/32/45312_2.png) [@AshishC](https://discuss.elastic.co/u/AshishC)\
**Post date:** [December 20, 2017, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928/4 "2017-12-20T17:30:41Z")

</div>

Thanks Abdon!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2018, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-multiple-types-problem/108928/5 "2018-01-17T17:30:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.