Events in queue, illegal_argument_exception, final mapping issue

[Ryan_Downey]

We are trying to use uberagent with Elasticsearch but cant seem to get communication between the two. We've set our receiver settings and uberAgent is sending data to Elasticsearch but it's queuing up.

The error message that I'm getting was pulled from the uberAgent logs:

2018-09-12 18:41:08.830 -0400,INFO ,(#########),4644,ReceiverStatistics,Elasticsearch; http://servername:9200 - Events in queue: 1, queue size: 91.9 KB, sent: 71, added to queue: 71, rejected from queue: 0

2018-09-12 18:41:08.870 -0400,ERROR,(##########),7912,SendData,One or more events could not be processed by the server http://servername:9200/uberagent/uberagent/_bulk. Error: "type":"illegal_argument_exception","reason":"Rejecting mapping update to [uberagent] as the final mapping would have more than 1 type: [uberagent, _doc]"

If I'm reading this correctly there are two mapping layers of uberagent, one in the index field and one in the type field, which is causing a conflict when data is trying to be input into the system (ie you have types). So /uberagent/uberagent is where the problem on our server lies.

This is also the first bit of the json file that were using it when we install. Should the "index_patterns" : ["uberagent*], field be changed to just * or something else?
{
"index_patterns": ["uberagent*"],
"order": 100,
"mappings":
{
"uberagent":
{
"_all": {"enabled": false},
"dynamic": "strict",
"date_detection": false,

     "properties":
     {
        "time" : {"type" : "date"},
        
        "Sourcetype" : {"type" : "keyword", "index": true},
        "host" : {"type" : "keyword", "index": true},
        "SessionGUID" : {"type" : "keyword", "index": true},

[gmoskovicz (Gabriel Moskovicz)]

Hi Ryan,

The error clearly as you saw is:

Rejecting mapping update to [uberagent] as the final mapping 
would have more than 1 type: [uberagent, _doc]

This error means one of the following:
1.The index was created with a type uberagent and now your uberagent is trying to send a type _doc
2. The index was created with a type _doc and now your uberagent is trying to send a type uberagent

You can retrieve the index that was created and check the mappings to see the type. I think that uberagent will be under mapping and not _doc, which means that the uberagent should be sending documents with types uberagent rather than _doc. Otherwise if the uberagent can't do that, i would recommend to change the mapping to use _doc rather than uberagent in your template.

Thanks!

--Gabriel