# Existing mapping for \[field name\] must be of type object but found \[field type\] **URL:** \ **Category:** Logstash\ **Created:** [September 13, 2018, 6:09am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411 "2018-09-13T06:09:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\ **Post date:** [September 13, 2018, 6:09am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/1 "2018-09-13T06:09:55Z")
Dear All, I split a list of data into different events. Here's the example data data source > 1.178.179.217 > 1.179.170.7 > 1.93.0.224 > 100.16.243.115 > 101.187.28.8 After split to different event, i put a template to change the field type of "BadIP" to "ip" as follow > { > "template\_4": { > "order": 0, > "index\_patterns": [ > "test" > ], > "settings": {}, > "mappings": { > "doc": { > "properties": { > "BadIP": { > "type": "ip" > } > } > } > }, > "aliases": {} > } > } Then, I try to use geoip to map those ips as follow > filter{ > if "feed" in [tags]{ > split {field =\> "message"} > grok { match =\> {"message" =\> "%{IP:BadIP}"}} > > geoip{ > source =\> "BadIP" > target =\> "BadIP.geoip" > add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}"] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}"] > } > mutate{ convert =\> ["[geoip][coordinates]", "float"]} > } > } However, it show following message. I don'y understand what is the meaning of "Existing mapping for [BadIP] must be of type object but found [ip]". Any idea? Thanks > [2018-09-12T17:52:51,508][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"test", :\_type=\>"doc", :\_routing=\>nil}, > #LogStash::Event:0x30c6b249], :response=\>{"index"=\>{"\_index"=\>"test", "\_type"=\>"doc", "\_id"=\>"8JMyzWUBA8S-QR9OfTd8", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Could not > dynamically add mapping for field [BadIP.geoip]. Existing mapping for [BadIP] must be of type object but found [ip]."}}}} ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [September 17, 2018, 1:37am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/2 "2018-09-17T01:37:55Z")
This message is coming back directly from Elasticsearch. The result of your current pipeline is attempting to insert a value on a field that is _different_ than what Elasticsearch expects for that field, and Elasticsearch was unable to coerce the value. In your case, Elasticsearch is expecting the value of `BadIP` to be coercible to an `ip` (that is, a string representing an IPv4 or IPV6 address), but your output is sending an object. I think that the source of this problem is your configuration in your GeoIP Filter, where you target the result of the GeoIP lookup to `BadIP.geoip`, since Elasticsearch uses dot-separator notation. ---
**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\ **Post date:** [September 17, 2018, 2:02am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/3 "2018-09-17T02:02:18Z")
Hi Yaauie, Thanks for your reply. I try to change Bad.geoip to Bad\_geoip and it works. However, I don't understand that there are other field don't have this problem, such as firewall.source.geoip. Is it because the field BadIP has the word "IP" and there is a dot after that? Thanks ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [September 17, 2018, 2:05am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/4 "2018-09-17T02:05:43Z")
No. The problem is that the Elasticsearch index that you are inserting to already has a field called `BadIP`, and that field is an `ip` in the current mapping. In Elasticsearch, types of any given field need to be consistent across the entire index. ---
**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\ **Post date:** [September 18, 2018, 2:04am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/5 "2018-09-18T02:04:10Z")
I see. thanks a lot ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 16, 2018, 2:08am UTC](https://discuss.elastic.co/t/existing-mapping-for-field-name-must-be-of-type-object-but-found-field-type/148411/6 "2018-10-16T02:08:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.