Elasticsearch mapper_parsing_exception

Elastic Stack Elasticsearch
1

When I'm making changes to my mapping template, all the input is written to logstash.log file and no index is created; along with the below errors.

MApping.json

{
"template" : "gfn*",
"order" : 0,
"template" : "gfn*",
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"require" : {
"box_type" : "hot"
}
}
}
}
},
"mappings" : {
"default" : {
"_all" : {
"enabled" : false
}
},
"properties" : {
"Action" : {
"index" : "not_analyzed",
"type" : "string"
},
"DeviceTime" : {
"format" : "strict_date_optional_time||epoch_millis",
"type" : "date"
},
"EventOutcome" : {
"index" : "not_analyzed",
"type" : "string"
},
"Category" : {
"index" : "not_analyzed",
"type" : "string"
},
"CEF_Version" : {
"index" : "not_analyzed",
"type" : "string"
},
"URLaccessed" : {
"index" : "not_analyzed",
"type" : "string"
},
"RequestMethod" : {
"index" : "not_analyzed",
"type" : "string"
},
"DeviceGroup" : {
"type" : "string"
},
"SourcePort" : {
"index" : "not_analyzed",
"type" : "string"
},
"DestinationPort" : {
"index" : "not_analyzed",
"type" : "string"
},
"out" : {
"index" : "not_analyzed",
"type" : "long"
},
"SignatureID" : {
"index" : "not_analyzed",
"type" : "string"
},
"SessionInformation" : {
"index" : "not_analyzed",
"type" : "string"
},
"SourceIP" : {
"index" : "not_analyzed",
"type" : "string"
},
"act" : {
"index" : "not_analyzed",
"type" : "string"
},
"DeviceProduct" : {
"index" : "not_analyzed",
"type" : "string"
},
"host" : {
"index" : "not_analyzed",
"type" : "string"
},
"DeviceVendor" : {
"index" : "not_analyzed",
"type" : "string"
},
"Significance" : {
"index" : "not_analyzed",
"type" : "string"
},
"DeviceHost" : {
"index" : "not_analyzed",
"type" : "string"
},
"in" : {
"index" : "not_analyzed",
"type" : "long"
},
"index" : {
"index" : "analyzed",
"type" : "string"
},
"Severity" : {
"index" : "not_analyzed",
"type" : "string"
},
"SourceHostname" : {
"index" : "not_analyzed",
"type" : "string"
},
"message" : {
"index" : "analyzed",
"type" : "string"
},
"DestinationHostname" : {
"index" : "not_analyzed",
"type" : "string"
},
"DestinationIP" : {
"index" : "not_analyzed",
"type" : "string"
},
"TimeZone" : {
"index" : "not_analyzed",
"type" : "string"
},
"Username" : {
"index" : "not_analyzed",
"type" : "string"
},
"port" : {
"index" : "not_analyzed",
"type" : "long"
},
"EventID" : {
"index" : "not_analyzed",
"type" : "string"
},
"Object" : {
"index" : "not_analyzed",
"type" : "string"
},
"Application" : {
"index" : "not_analyzed",
"type" : "string"
},
"ignore_malformed": true
}
}
}
}

2

Logstash.log

"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Failed to parse mapping [properties]: Root mapping definition has unsupported parameters: [Action : {index=not_analyzed, type=string}] [DeviceTime : {format=strict_date_optional_time||epoch_millis, type=date}] [EventOutcome : {index=not_analyzed, type=string}] [Category : {index=not_analyzed, type=string}] [CEF_Version : {index=not_analyzed, type=string}] [URLaccessed : {index=not_analyzed, type=string}] [RequestMethod : {index=not_analyzed, type=string}] [DeviceGroup : {type=string}] [ignore_malformed : true] [SourcePort : {index=not_analyzed, type=string}] [DestinationPort : {index=not_analyzed, type=string}] [out : {index=not_analyzed, type=long}] [SignatureID : {index=not_analyzed, type=string}] [SessionInformation : {index=not_analyzed, type=string}] [SourceIP : {index=not_analyzed, type=string}] [act : {index=not_analyzed, type=string}] [DeviceProduct : {index=not_analyzed, type=string}] [host : {index=not_analyzed, type=string}] [DeviceVendor : {index=not_analyzed, type=string}] [Significance : {index=not_analyzed, type=string}] [DeviceHost : {index=not_analyzed, type=string}] [in : {index=not_analyzed, type=long}] [index : {index=analyzed, type=string}] [Severity : {index=not_analyzed, type=string}] [SourceHostname : {index=not_analyzed, type=string}] [message : {index=analyzed, type=string}] [DestinationHostname : {index=not_analyzed, type=string}] [DestinationIP : {index=not_analyzed, type=string}] [TimeZone : {index=not_analyzed, type=string}] [Username : {index=not_analyzed, type=string}] [port : {index=not_analyzed, type=long}] [EventID : {index=not_analyzed, type=string}] [Object : {index=not_analyzed, type=string}] [Application : {index=not_analyzed, type=string}]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"Root mapping definition has unsupported parameters: [Action : {index=not_analyzed, type=string}] [DeviceTime : {format=strict_date_optional_time||epoch_millis, type=date}] [EventOutcome : {index=not_analyzed, type=string}] [Category : {index=not_analyzed, type=string}] [CEF_Version : {index=not_analyzed, type=string}] [URLaccessed : {index=not_analyzed, type=string}] [RequestMethod : {index=not_analyzed, type=string}] [DeviceGroup : {type=string}] [ignore_malformed : true] [SourcePort : {index=not_analyzed, type=string}] [DestinationPort : {index=not_analyzed, type=string}] [out : {index=not_analyzed, type=long}] [SignatureID : {index=not_analyzed, type=string}] [SessionInformation : {index=not_analyzed, type=string}] [SourceIP : {index=not_analyzed, type=string}] [act : {index=not_analyzed, type=string}] [DeviceProduct : {index=not_analyzed, type=string}] [host : {index=not_analyzed, type=string}] [DeviceVendor : {index=not_analyzed, type=string}] [Significance : {index=not_analyzed, type=string}] [DeviceHost : {index=not_analyzed, type=string}] [in : {index=not_analyzed, type=long}] [index : {index=analyzed, type=string}] [Severity : {index=not_analyzed, type=string}] [SourceHostname : {index=not_analyzed, type=string}] [message : {index=analyzed, type=string}] [DestinationHostname : {index=not_analyzed, type=string}] [DestinationIP : {index=not_analyzed, type=string}] [TimeZone : {index=not_analyzed, type=string}] [Username : {index=not_analyzed, type=string}] [port : {index=not_analyzed, type=long}] [EventID : {index=not_analyzed, type=string}] [Object : {index=not_analyzed, type=string}] [Application : {index=not_analyze d, type=string}]"}}}}, :level=>:warn}

3

What does your LS config look like?