# Events in queue, illegal\_argument\_exception, final mapping issue

**URL:** <https://discuss.elastic.co/t/events-in-queue-illegal-argument-exception-final-mapping-issue/148453>\
**Category:** Elasticsearch\
**Created:** [September 13, 2018, 1:00pm UTC](https://discuss.elastic.co/t/events-in-queue-illegal-argument-exception-final-mapping-issue/148453 "2018-09-13T13:00:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Downey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_downey/32/35987_2.png) [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Post date:** [September 13, 2018, 1:00pm UTC](https://discuss.elastic.co/t/events-in-queue-illegal-argument-exception-final-mapping-issue/148453/1 "2018-09-13T13:00:43Z")

</div>

We are trying to use uberagent with Elasticsearch but cant seem to get communication between the two. We've set our receiver settings and uberAgent is sending data to Elasticsearch but it's queuing up.

The error message that I'm getting was pulled from the uberAgent logs:

2018-09-12 18:41:08.830 -0400,INFO ,(#########),4644,ReceiverStatistics,Elasticsearch; [http://servername:9200](http://servername:9200) - Events in queue: 1, queue size: 91.9 KB, sent: 71, added to queue: 71, rejected from queue: 0

2018-09-12 18:41:08.870 -0400,ERROR,(##########),7912,SendData,One or more events could not be processed by the server [http://servername:9200/uberagent/uberagent/\_bulk](http://servername:9200/uberagent/uberagent/_bulk). Error: "type":"illegal\_argument\_exception","reason":"Rejecting mapping update to [uberagent] as the final mapping would have more than 1 type: [uberagent, \_doc]"

If I'm reading this correctly there are two mapping layers of uberagent, one in the index field and one in the type field, which is causing a conflict when data is trying to be input into the system (ie you have types). So /uberagent/uberagent is where the problem on our server lies.

This is also the first bit of the json file that were using it when we install. Should the "index\_patterns" : ["uberagent\*], field be changed to just \* or something else?  
{  
"index\_patterns": ["uberagent\*"],  
"order": 100,  
"mappings":  
{  
"uberagent":  
{  
"\_all": {"enabled": false},  
"dynamic": "strict",  
"date\_detection": false,

```
     "properties":
     {
        "time" : {"type" : "date"},
        
        "Sourcetype" : {"type" : "keyword", "index": true},
        "host" : {"type" : "keyword", "index": true},
        "SessionGUID" : {"type" : "keyword", "index": true},
```

---

<div class="post-metadata">

**Author:** ![gmoskovicz](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gmoskovicz](https://discuss.elastic.co/u/gmoskovicz)\
**Post date:** [September 14, 2018, 5:21pm UTC](https://discuss.elastic.co/t/events-in-queue-illegal-argument-exception-final-mapping-issue/148453/2 "2018-09-14T17:21:49Z")

</div>

Hi Ryan,

The error clearly as you saw is:

```auto
Rejecting mapping update to [uberagent] as the final mapping 
would have more than 1 type: [uberagent, _doc]

```

This error means one of the following:  
1.The index was created with a type `uberagent` and now your uberagent is trying to send a type `_doc`  
2. The index was created with a type `_doc` and now your uberagent is trying to send a type `uberagent`

You can retrieve the index that was created and check the mappings to see the type. I think that `uberagent` will be under `mapping` and not `_doc`, which means that the `uberagent` should be sending documents with types `uberagent` rather than `_doc`. Otherwise if the uberagent can't do that, i would recommend to change the `mapping` to use `_doc` rather than `uberagent` in your template.

Thanks!

--Gabriel

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2018, 5:21pm UTC](https://discuss.elastic.co/t/events-in-queue-illegal-argument-exception-final-mapping-issue/148453/3 "2018-10-12T17:21:51Z")

</div>

Closed on October 12, 2018, 5:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.