Elasticsearch update mapping from text field to multifield with keyword fails

[test_user]

Hi,

I am using

• Kibana 5.4:
• ElsaticSearch 5.4:
• Logstash: 5.4

I want to upgrade on my mapping (index without document delete documents with _delete_by_query) one single filed single field to multifiled.

Current Mapping:
curl -XGET 'localhost:9200/filebeat-2017.06.13/_mapping?pretty'
.
.
"message" : {
"type" : "text",
"norms" : false
},
.
.

My Idea is to add "keyword" type field (as recommended mutlti field documentation) with following curl request, but it fails:

mpx@mqzhlmpx07:~> curl -XPUT 'localhost:9200/filebeat-2017.06.13/_mapping/log?pretty' -H 'Content-Type: application/json' -d'
{
"properties": {
"message": {
"type": "keyword"
}
}
}
'
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "mapper [message] of different type, current_type [text], merged_type [keyword]"
}
],
"type" : "illegal_argument_exception",
"reason" : "mapper [message] of different type, current_type [text], merged_type [keyword]"
},
"status" : 400
}

Please help

[Christian_Dahlqvist]

You can not update mappings on an existing index, so you will need to reindex into a new index with the updated mappings.

[test_user]

It is an empty index (all documents deleted by curl request) in order to avoid reindexing. According https://www.elastic.co/blog/changing-mapping-with-zero-downtime, I did following:
mpx@mqzhlmpx07:/var/opt/six/mpx/Kibana> curl -XPUT 'localhost:9200/filebeat-2017.06.13/_mapping/log?pretty' -H 'Content-Type: application/json' -d'
{
"log": {
"properties": {
"message": {
"type": "multi_field",
"fields": {
"message": { "type": "text" },
"message_k": { "type": "keyword" }
}
}
}
}
}
'
{
"error" : {
"root_cause" : [
{
"type" : "mapper_parsing_exception",
"reason" : "No handler for type [multi_field] declared on field [message]"
}
],
"type" : "mapper_parsing_exception",
"reason" : "No handler for type [multi_field] declared on field [message]"
},
"status" : 400
}

Please tell me what is now wrong? (something to do with norms property?)

[test_user]

Hello all,

Thanks to my valuable team members, I could elegantly solve the issue: Quoting the expression is solving the issue.
Example:
GET _search
{
"query": {
"query_string": {"query": "message: "215.SODHK""}
}
}

Thus there is no need for an update on generated mapping. For me is this case closed