I am using the following command to insert data into my index:
curl -H "Content-Type: application/json" -X POST "http://localhost:9200/test-syntax/_doc/10" --data-binary @1278.json
The contents of 1278.json is:
{
"audit_types": "any text",
"date_time": "Mon Nov 4 14:53:12 2019",
"findings": {
"CiscoIOS": {
"finding 1": {
"f1": "text here"
}
}
}
}
And get the error:
"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"failed to parse field [findings.CiscoIOS.finding 1] of type [text] in document with id '10'. Preview of field's value: '{f1=text here}'"}],"type":"mapper_parsing_exception","reason":"failed to parse field [findings.CiscoIOS.finding 1] of type [text] in document with id '10'. Preview of field's value: '{f1=text here}'","caused_by":{"type":"illegal_state_exception","reason":"Can't get text on a START_OBJECT at 6:20"}},"status":400}
Now the strange part:
If I change the input JSON CiscoIOS to CiscoIOs -- it works!
{
"audit_types": "any text",
"date_time": "Mon Nov 4 14:53:12 2019",
"findings": {
"CiscoIOs": {
"finding 1": {
"f1": "text here"
}
}
}
}
{"_index":"test-syntax","_type":"_doc","_id":"10","_version":14,"result":"updated","_shards":{"total":1,"successful":1,"failed":0},"_seq_no":583,"_primary_term":1}
What is going on here?
I have a mapping in the index for the time format.
settings= {
"settings": {
"number_of_shards" : 1,
"number_of_replicas" : 0,
"index.mapping.depth.limit" : 50
},
"mappings": {
"properties": {
"date_time" : { "type" : "date", "format" : "EEE MMM d[d] HH:mm:ss yyyy" }
}
}
}
Any clues appreciated! Elastic version below
{
"name" : "TWUKLAPTOP79",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "-Ytbr3v8TQWVaa6y2PNRRw",
"version" : {
"number" : "7.4.2",
"build_flavor" : "unknown",
"build_type" : "unknown",
"build_hash" : "2f90bbf7b93631e52bafb59b3b049cb44ec25e96",
"build_date" : "2019-10-28T20:40:44.881551Z",
"build_snapshot" : false,
"lucene_version" : "8.2.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}