Elasticsearch mapping template not getting uploaded

Elastic Stack Elasticsearch
1

Getting the following error while uploading the ES index template.

$ curl  -H 'Content-Type: application/json'  -XPUT http://localhost:9200/_template/logs_template?pretty -d @logs_template.json
{
  "error" : {
    "root_cause" : [
      {
        "type" : "mapper_parsing_exception",
        "reason" : "Root mapping definition has unsupported parameters:  [app : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_file : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_connect_time : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container_name : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [content_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [app_instance : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_line : {type=long}] [code_func : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_ip : {type=ip}]"
      }
    ],
    "type" : "mapper_parsing_exception",
    "reason" : "Failed to parse mapping [_default_]: Root mapping definition has unsupported parameters:  [app : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_file : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_connect_time : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container_name : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [content_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [app_instance : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_line : {type=long}] [code_func : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_ip : {type=ip}]",
    "caused_by" : {
      "type" : "mapper_parsing_exception",
      "reason" : "Root mapping definition has unsupported parameters:  [app : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_file : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_connect_time : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [container_name : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [content_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [app_instance : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [code_line : {type=long}] [code_func : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_ip : {type=ip}]"
    }
  },
  "status" : 400
}
}

Here is my index template I have verified on jsonlint that it's a valid json not sure what's causing the issue?

No existing index is present

$ curl http://localhost:9200/_cat/indices?pretty
green open .kibana e5a5icv9RXmA4-PGafo6eA 1 0 2 0 14.3kb 14.3kb

ES version is 6.2.4

2

https://paste.fedoraproject.org/paste/~8acz~tlCH5FCDvZfWNHsQ

template.

3 
{
    "mappings": {
        "_default_":å {
            "app": {
                "fields": {
                    "keyword": {
                        "ignore_above": 256,
                        "type": "keyword"
                    }
                },
                "type": "text"
            },

Do you see the å typo?

4

strangely I don't see in the vim or sublime.

{
	"template": "logs-*",
	"settings": {
		"index.refresh_interval": "5s"
	},
	"mappings": {
		"_default_": {
			"properties": {
				"@version": {
					"type": "text",
					"fields": {
						"keyword": {
							"type": "keyword",
							"ignore_above": 256
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.