I can't reproduce this. Here a copy of a terminal session showing a sequence of curl
commands run on a completely fresh Elasticsearch 5.6.8 installation, in which the document is indexed with no errors:
Put template with mapping
$ curl -v -XPUT 'http://localhost:9200/_template/packets' -H 'Content-type: application/json' --data-binary $'{"mappings":{"pcap_file":{"dynamic":"false","properties":{"layers":{"properties":{"ip":{"properties":{"ip_ip_dst":{"type":"ip"},"ip_ip_src":{"type":"ip"}}},"udp":{"properties":{"udp_udp_srcport":{"type":"integer"},"udp_udp_dstport":{"type":"integer"}}},"frame":{"properties":{"frame_frame_protocols":{"type":"keyword"},"frame_frame_len":{"type":"long"}}}}},"timestamp":{"type":"date"}}}},"settings":{"number_of_shards":1,"number_of_replicas":0},"template":"packets-*"}'
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 9200 (#0)
> PUT /_template/packets HTTP/1.1
> Host: localhost:9200
> User-Agent: curl/7.54.0
> Accept: */*
> Content-type: application/json
> Content-Length: 468
>
* upload completely sent off: 468 out of 468 bytes
< HTTP/1.1 200 OK
< content-type: application/json; charset=UTF-8
< content-length: 21
<
* Connection #0 to host localhost left intact
{"acknowledged":true}
Show head and tail of file
(sorry, can't show it all, it pushes this message over the size limit)
$ head -c200 singolopacchetto.json
{"index":{"_index":"packets-2018-04-25","_type":"pcap_file"}}
{"layers":{"frame":{"frame.interface_id":"0","frame.interface_id_tree":{"frame.interface_name":"any"},"frame.encap_type":"25","frame.time"
$ tail -c50 singolopacchetto.json
:{"json.value.number":"10","json.key":"size"}}}}}
Checksum contents of file
$ shasum singolopacchetto.json
4d603b226395c66b88747f66044b5e47436a2aa9 singolopacchetto.json
Put document using given command line
$ curl -v 'http://localhost:9200/packets-2018-04-25/pcap_file/_bulk?pretty' -H 'Content-type: application/json' --data-binary @singolopacchetto.json
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 9200 (#0)
> POST /packets-2018-04-25/pcap_file/_bulk?pretty HTTP/1.1
> Host: localhost:9200
> User-Agent: curl/7.54.0
> Accept: */*
> Content-type: application/json
> Content-Length: 5957
> Expect: 100-continue
>
< HTTP/1.1 100 Continue
* We are completely uploaded and fine
< HTTP/1.1 200 OK
< content-type: application/json; charset=UTF-8
< content-length: 418
<
{
"took" : 330,
"errors" : false,
"items" : [
{
"index" : {
"_index" : "packets-2018-04-25",
"_type" : "pcap_file",
"_id" : "AWMXTI7T_QeHdqozGVFr",
"_version" : 1,
"result" : "created",
"_shards" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"created" : true,
"status" : 201
}
}
]
}
* Connection #0 to host localhost left intact
Put document (correct Content-type
, and using index & type given in file)
$ curl -v 'http://localhost:9200/_bulk' -H 'Content-type: application/x-ndjson' --data-binary @singolopacchetto.json
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 9200 (#0)
> POST /_bulk HTTP/1.1
> Host: localhost:9200
> User-Agent: curl/7.54.0
> Accept: */*
> Content-type: application/x-ndjson
> Content-Length: 5957
> Expect: 100-continue
>
< HTTP/1.1 100 Continue
* We are completely uploaded and fine
< HTTP/1.1 200 OK
< content-type: application/json; charset=UTF-8
< content-length: 235
<
* Connection #0 to host localhost left intact
{"took":27,"errors":false,"items":[{"index":{"_index":"packets-2018-04-25","_type":"pcap_file","_id":"AWMXTKmh_QeHdqozGVFs","_version":1,"result":"created","_shards":{"total":1,"successful":1,"failed":0},"created":true,"status":201}}]}