Error with indexing nested object (Elasticsearch 5.6)

Elastic Stack Elasticsearch
1

Hello,
I get an error (logstash error"=>{"type"=>"illegal_argument_exception", "reason"=>"object mapping [sender_mail] can't be changed from nested to non-nested) when I index a nested object field with logstash in Elasticsearch.
Yet my mapping and the nested object field created from logstash are correct.
Below my mapping:

PUT _template/mail 
{
	....
    "sender_mail": {
      "type": "nested",
      "properties": {
        "id": {
          "type": "integer"
        },
        "mail": {
          "type": "keyword",
          "ignore_above": 1024
        }
      }
    }
	....
 }

And the logstash code for creating my nested object field:

aggregate {
task_id => "%{mail_id}"
code => "
		if !event.get('sender_mail').nil? 
			map['sender_mail'] ||= []
			map['sender_mail'] << { 'mail' => event.get('mail'), 'id' => event.get('id') }
		end
}

And I get a nested object of this format with this code above:

"sender_mail": [
  {
   "id": "0",
    "mail": "xxx1@gmail.com"
 },
  {
   "id": "1",
   "mail": "xxx2@gmail.com"
  },
  {
  "id": "2",
  "mail": "xxx3@gmail.com"
  }
]

If I remove the field sender_mail (nested object) in the mapping, the field is well created but not with the good datatype (nested):
Capture_nested
And in my mapping he creates me for the field nested object with this datatype by default :

.....
"sender_mail": {
"properties": {
"id": {
"type": "text",
"fields": {
  "keyword": {
	"type": "keyword",
	"ignore_above": 256
  }
}
},
"mail": {
"type": "text",
"fields": {
  "keyword": {
	"type": "keyword",
	"ignore_above": 256
    }
   }
  }
 }
},
.....

Which means that my sender_mail field actually has the correct json format but why do I have this error when I put in my mapping the datatype nested with this syntax?

PUT _template/mail 
{
	....
    "sender_mail": {
      "type": "nested",
      "properties": {
        "id": {
          "type": "integer"
        },
        "mail": {
          "type": "keyword",
          "ignore_above": 1024
        }
      }
    }
	....
 }

Ps: I specify when I do tests manually with this same field recovered after indexing, I have no error so why by automating from ingestion logstash it does not work?

Thank you for your help!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.