Hi,
I'm trying to figure out something that happened to me just today, where Elasticsearch suddenly refuses to accept certain documents from logstash.
latest versions of both (2.2.0 and 2.2.2)
this is the error i get in logstash:
"create" => {
"_index" => "logstash-2016.03.03", "_type" => "messages", "_id" => "AVM9UIT24Ex8CdW4NE8u", "status" => 400, "error" => {
"type" => "illegal_argument_exception", "reason" => "Field [body] is defined as a field in mapping [internalServerErrorReport] but this name is already used for an object in other types"
}
please help!
thanks in advance
Benjamin
got another related error in logstash...
pretty sure its the relevant to the same issue:
"error"=>{"type"=>"illegal_argument_exception", "reason"=>"Can't merge a non object mapping [body.xxx] with an object mapping [body.xxx]"}}}
any ideas?
It seems like the 'body' field in the index is mapped as an object in some types and that you are then trying to index documents where it instead is mapped as a field, which causes a mapping conflict, preventing the documents to be indexed. Look at the mappings for the index as well as the documents that get rejected.
so just to verify that I understand correctly, when I send a document with "body" for example as a json object, and elasticsearch already has a mapping of "body" as field\string, so this happens?
how can I overcome this?
A field can only have one mapping in an index, so you will need to either rename the field with one of the mappings or index it into a different index.
in something like this for example, how can i go about finding the problematic Fields and mappings?
[2016-03-07 08:32:54,156][DEBUG][action.bulk ] [ip-xxxxxxx] [logstash-2016.03.07][4] failed to execute bulk item (index) index {[logstash-2016.03.07][internalServerErrorReport][AVNQNZoswu293zyTaS8A], source[{"url":"http://xx.xx.xx:xx/v1/registration/device/pushCredentials?userId=xxxx&domain=xxxx.com&deviceId=xxxxxx","shortUrl":"http://xxx.xxx.xxx:xxxx/v1/registration/device/pushCredentials_post","type":"internalServerErrorReport","error":null,"body":"{\"pushPlatform\":\"xxxx\",\"clientSwVersion\":xxxx,\"credentials\":{\"token\":\"xxxx\",\"bundle_id\":\"xxxx\"},\"restVersion\":\"1.2\"}","responseBody":"{\"error\":\"No row object under ROOT!\"}","statusCode":500,"APIVersion":"1.2","@version":"1","@timestamp":"2016-03-07T08:30:39.614Z","host":"xxxxxx"}]}
java.lang.IllegalArgumentException: Field [body] is defined as a field in mapping [internalServerErrorReport] but this name is already used for an object in other types
Use the get mapping API to get the mapping in use for the index the error is reported for and compare this to the document the error was thrown for.
Hi again,
I just want to get this straight... I cannot have same name fields with different mappings? while on different types?
That is correct. It is enforced per index in Elasticsearch 2.x.
thank you very much.
just out of curiosity, is there some documentation or maybe you can explain to me shortly, what is the rational behind this enforcement?
a lot of people in our company were quite surprised to hear about this, and consider it to be a limitation from our point of view... (everything was working fine in 1.x)