Error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"analyzer [analyzer_keyword] not found for field

Elastic Stack Elasticsearch
1

Hello Team,

When I am creating new index I am getting below error

"curl -X PUT [localhost:9200/holly_good](http://localhost:9200/holly_good) -H 'Content-Type: application/json' -d @new.json "

but it gave below error

{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"analyzer [analyzer_keyword] not found for field [source]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [message]: analyzer [analyzer_keyword] not found for field [source]","caused_by":{"type":"mapper_parsing_exception","reason":"analyzer [analyzer_keyword] not found for field [source]"}},"status":400}

Content of new.json

{"mappings" : {
      "message" : {
        "dynamic_templates" : [
          {
            "internal_fields" : {
              "match" : "gl2_*",
              "match_mapping_type" : "string",
              "mapping" : {
                "type" : "keyword"
              }
            }
          },
          {
            "store_generic" : {
              "match_mapping_type" : "string",
              "mapping" : {
                "type" : "keyword"
              }
            }
          }
        ],
        "properties" : {
          "LoggerName" : {
            "type" : "keyword"
          },
          "MessageParam0" : {
            "type" : "keyword"
          },
          "MessageParam1" : {
            "type" : "long"
          },
          "MessageParam2" : {
            "type" : "keyword"
          },
          "MessageParam3" : {
            "type" : "keyword"
          },
          "MessageParam4" : {
            "type" : "keyword"
          },
          "MessageParam5" : {
            "type" : "keyword"
          },
          "MessageParam6" : {
            "type" : "keyword"
          },
          "MessageParam7" : {
            "type" : "keyword"
          },
          "MessageParam8" : {
            "type" : "keyword"
          },
          "Severity" : {
            "type" : "keyword"
          },
          "SourceClassName" : {
            "type" : "keyword"
          },
          "SourceMethodName" : {
            "type" : "keyword"
          },
          "SourceSimpleClassName" : {
            "type" : "keyword"
          },
          "StackTrace" : {
            "type" : "keyword"
          },
          "Thread" : {
            "type" : "keyword"
          },
          "Time" : {
            "type" : "keyword"
          },
          "facility" : {
            "type" : "keyword"
          },
          "full_message" : {
            "type" : "text",
            "analyzer" : "standard"
          },
          "gl2_accounted_message_size" : {
            "type" : "long"
          },
          "gl2_message_id" : {
            "type" : "keyword"
          },
          "gl2_processing_timestamp" : {
            "type" : "date",
            "format" : "yyyy-MM-dd HH:mm:ss.SSS"
          },
          "gl2_receive_timestamp" : {
            "type" : "date",
            "format" : "yyyy-MM-dd HH:mm:ss.SSS"
          },
          "gl2_remote_ip" : {
            "type" : "keyword"
          },
          "gl2_remote_port" : {
            "type" : "long"
          },
          "gl2_source_input" : {
            "type" : "keyword"
          },
          "gl2_source_node" : {
            "type" : "keyword"
          },
          "level" : {
            "type" : "long"
          },
          "message" : {
            "type" : "text",
            "analyzer" : "standard"
          },
          "source" : {
            "type" : "text",
            "analyzer" : "analyzer_keyword",
            "fielddata" : true
          },
          "streams" : {
            "type" : "keyword"
          },
          "timestamp" : {
            "type" : "date",
            "format" : "yyyy-MM-dd HH:mm:ss.SSS"
          }
        }
      }
    }
  }
}

Can you tell me what is wrong i am doing here.

Regards,
SAM

2

Hi!!

You need to define the analyzer "analyzer_keyword" like this example:

{
   "settings": {
     "analysis": {
       "analyzer": {
         "analyzer_keyword": {
           "type": "custom",
           "tokenizer": "standard",
           "filter": [
             .....
           ]
         }
       }
     }
   }
}
3

Thank you @RabBit_BR ,

can you tell me where to place this definition in above json, any specific sequence or anywhere it will do, since I am new to ES and learning how it works,

4

@RabBit_BR

I updated above as per my understanding

{

    "mappings" : {

      "message" : {

        "dynamic_templates" : [

          {

            "internal_fields" : {

              "match" : "gl2_*",

              "match_mapping_type" : "string",

              "mapping" : {

                "type" : "keyword"

              }

            }

          },

          {

            "store_generic" : {

              "match_mapping_type" : "string",

              "mapping" : {

                "type" : "keyword"

              }

            }

          }

        ],

        "properties" : {

          "LoggerName" : {

            "type" : "keyword"

          },

          "MessageParam0" : {

            "type" : "keyword"

          },

          "MessageParam1" : {

            "type" : "long"

          },

          "MessageParam2" : {

            "type" : "keyword"

          },

          "MessageParam3" : {

            "type" : "keyword"

          },

          "MessageParam4" : {

            "type" : "keyword"

          },

          "MessageParam5" : {

            "type" : "keyword"

          },

          "MessageParam6" : {

            "type" : "keyword"

          },

          "MessageParam7" : {

            "type" : "keyword"

          },

          "MessageParam8" : {

            "type" : "keyword"

          },

          "Severity" : {

            "type" : "keyword"

          },

          "SourceClassName" : {

            "type" : "keyword"

          },

          "SourceMethodName" : {

            "type" : "keyword"

          },

          "SourceSimpleClassName" : {

            "type" : "keyword"

          },

          "StackTrace" : {

            "type" : "keyword"

          },

          "Thread" : {

            "type" : "keyword"

          },

          "Time" : {

            "type" : "keyword"

          },

          "facility" : {

            "type" : "keyword"

          },

          "full_message" : {

            "type" : "text",

            "analyzer" : "standard"

          },

          "gl2_accounted_message_size" : {

            "type" : "long"

          },

          "gl2_message_id" : {

            "type" : "keyword"

          },

          "gl2_processing_timestamp" : {

            "type" : "date",

            "format" : "yyyy-MM-dd HH:mm:ss.SSS"

          },

          "gl2_receive_timestamp" : {

            "type" : "date",

            "format" : "yyyy-MM-dd HH:mm:ss.SSS"

          },

          "gl2_remote_ip" : {

            "type" : "keyword"

          },

          "gl2_remote_port" : {

            "type" : "long"

          },

          "gl2_source_input" : {

            "type" : "keyword"

          },

          "gl2_source_node" : {

            "type" : "keyword"

          },

          "level" : {

            "type" : "long"

          },

          "message" : {

            "type" : "text",

            "analyzer" : "standard"

          },

          "source" : {

            "type" : "text",

            "analyzer" : "analyzer_keyword",

            "fielddata" : true

          },

          "streams" : {

            "type" : "keyword"

          },

          "timestamp" : {

            "type" : "date",

            "format" : "yyyy-MM-dd HH:mm:ss.SSS"

          },

          "settings": {

            "analysis": {

              "analyzer": {

                "analyzer_keyword": {

                  "type": "custom",

                  "tokenizer": "standard",

                  "filter": [

                    "string"

                  ]

                }

              }

            }

          }

        }

      }

    }

  }

but now I am getting below error

curl -X PUT http://localhost:9200/graylog_new -H 'Content-Type: application/json' -d @log.json
{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"No type specified for field [settings]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [message]: No type specified for field [settings]","caused_by":{"type":"mapper_parsing_exception","reason":"No type specified for field [settings]"}},"status":400}

Could you please guide.

Regards,
SAM

5

Hi!

I don't know how you created the mapping but I saw that you use an analyzer called "analyzer_keyword" and the error occurs because you don't define this analyzer.

If you got the mapping from another index you need to run this command:

GET your_index/_settings

In the answer you will see a attribute called "analyzer" and in it will be the "analyzer_keyword" that you want to use. You can copy it and add it to your file.

I'll show you an example of what the final file should look like(observe que o analyzer_keyword que criei é apenas um exemplo):

{
  "settings": {
    "analysis": {
      "analyzer": {
        "analyzer_keyword": {
          "type": "custom",
          "tokenizer": "standard",
          "filter": [
            "lowercase"
          ]
        }
      }
    }
  },
  "mappings": {
    "dynamic_templates": [
      {
        "internal_fields": {
          "match": "gl2_*",
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword"
          }
        }
      },
      {
        "store_generic": {
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ],
    "properties": {
      "LoggerName": {
        "type": "keyword"
      },
      "MessageParam0": {
        "type": "keyword"
      },
      "MessageParam1": {
        "type": "long"
      },
      "MessageParam2": {
        "type": "keyword"
      },
      "MessageParam3": {
        "type": "keyword"
      },
      "MessageParam4": {
        "type": "keyword"
      },
      "MessageParam5": {
        "type": "keyword"
      },
      "MessageParam6": {
        "type": "keyword"
      },
      "MessageParam7": {
        "type": "keyword"
      },
      "MessageParam8": {
        "type": "keyword"
      },
      "Severity": {
        "type": "keyword"
      },
      "SourceClassName": {
        "type": "keyword"
      },
      "SourceMethodName": {
        "type": "keyword"
      },
      "SourceSimpleClassName": {
        "type": "keyword"
      },
      "StackTrace": {
        "type": "keyword"
      },
      "Thread": {
        "type": "keyword"
      },
      "Time": {
        "type": "keyword"
      },
      "facility": {
        "type": "keyword"
      },
      "full_message": {
        "type": "text",
        "analyzer": "standard"
      },
      "gl2_accounted_message_size": {
        "type": "long"
      },
      "gl2_message_id": {
        "type": "keyword"
      },
      "gl2_processing_timestamp": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss.SSS"
      },
      "gl2_receive_timestamp": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss.SSS"
      },
      "gl2_remote_ip": {
        "type": "keyword"
      },
      "gl2_remote_port": {
        "type": "long"
      },
      "gl2_source_input": {
        "type": "keyword"
      },
      "gl2_source_node": {
        "type": "keyword"
      },
      "level": {
        "type": "long"
      },
      "message": {
        "type": "text",
        "analyzer": "standard"
      },
      "source": {
        "type": "text",
        "analyzer": "analyzer_keyword",
        "fielddata": true
      },
      "streams": {
        "type": "keyword"
      },
      "timestamp": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss.SSS"
      }
    }
  }
}
1 Like
6

Thanks @RabBit_BR

for your guidance and explanation, I have understood what I was doing wrong and what I have to correct, I will keep this in mind from onwards,

This helped me GET your_index/_settings

Once again thank you for your support & time.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.