# Failed to parse value \[no\]

**URL:** <https://discuss.elastic.co/t/failed-to-parse-value-no/107982>\
**Category:** Elasticsearch\
**Created:** [November 16, 2017, 4:30pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982 "2017-11-16T16:30:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 16, 2017, 4:30pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/1 "2017-11-16T16:30:09Z")

</div>

I am getting this error after my upgrade to 6.0 GA

```
[2017-11-16T11:16:50,464][DEBUG][o.e.a.b.TransportShardBulkAction] [logs.web-2017.11.01][0] failed to execute bulk item (index) BulkShardRequest [[logs.web-2017.11.01][0]] containing [index {[...]}]
org.elasticsearch.index.mapper.MapperParsingException: failed to parse
        at org.elasticsearch.index.mapper.DocumentParser.wrapInMapperParsingException(DocumentParser.java:175) ~[elasticsearch-6.0.0.jar:6.0.0]
[...]Caused by: java.lang.IllegalArgumentException: Could not convert [useragent.index] to boolean
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:433) ~[elasticsearch-6.0.0.jar:6.0.0]
[...]
Caused by: java.lang.IllegalArgumentException: Failed to parse value [no] as only [true] or [false] are allowed.
        at org.elasticsearch.common.Booleans.parseBoolean(Booleans.java:73) ~[elasticsearch-6.0.0.jar:6.0.0]
```

I initially thought it might be caused by a template containing this

```
{ "useragent": { "path_match": "web.useragent", "mapping": { "type": "keyword", "index": "no" } } }
```

but I have updated the template to make that "false" instead of of "no", restarted es, and I still get the same error.

A GET on that template in dev tools / console shows it had been updated with a new version number and the value "false". I am at a loss as to where to look next.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 16, 2017, 4:51pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/2 "2017-11-16T16:51:58Z")

</div>

I think you need to look at your source documents. Specifically what contains field `useragent.index`. What is its mapping and what does a document look like?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 16, 2017, 5:16pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/3 "2017-11-16T17:16:49Z")

</div>

That field does not exist in the source document.

[2017-11-16T11:31:49,544][DEBUG][o.e.a.b.TransportShardBulkAction] [logs.web-2017.11.01][1] failed to execute bulk item (index) BulkShardRequest [[logs.web-2017.11.01][1]] containing [index {[logs.web-2017.11.01][doc][Dn6sxV8BHDVRZ8TJE-AN], source[{"web.method":"GET","web.cbytes":867,"web.sbytes":437,"web.ua\_details":{"os":"iOS","major":"11","minor":"0","build":"","os\_minor":"0","os\_major":"11","name":"Mobile Safari","os\_name":"iOS","device":"iPhone"},"web.port":"4444","geoip":{"timezone":"America/New\_York","ip":"a.b.c.d","latitude":27.9658,"continent\_code":"NA","city\_name":"Clearwater","country\_name":"United States","country\_code2":"US","dma\_code":539,"country\_code3":"US","region\_name":"Florida","location":{"lon":-82.8001,"lat":27.9658},"postal\_code":"33756","region\_code":"FL","longitude":-82.8001},"web.timetaken":1187,"web.referer":"[http://www.example.com](http://www.example.com)","web.subresponse":"0","web.useragent":"Mozilla/5.0 (iPhone; CPU iPhone OS 11\_0\_3 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A432 Safari/604.1","web.server\_ip":"e.f.g.h","@timestamp":"2017-11-01T00:00:00.000Z","web.request":"/someURI","@version":"1","host":"myMachine","web.user\_id":"-","web.sysdate":"2017-11-01 00:00:00","web.querystring":"...","web.fqdn\_referer":"[www.example.com](http://www.example.com)","web.responsestatus":"302","web.client\_ip":"a.b.c.d","web.extension":"do"}]}]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 16, 2017, 5:58pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/4 "2017-11-16T17:58:44Z")

</div>

Looking at the stack trace and having reviewed the code, it does appear to be parsing the mapping to find the type of the field. And before I fixed it the mapping did contain "no". What is baffling me is that kibana sees the updated mapping but es appears not to, even after a restart.

```
Caused by: java.lang.IllegalArgumentException: Failed to parse value [no] as only [true] or [false] are allowed.
        at org.elasticsearch.common.Booleans.parseBoolean(Booleans.java:73) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:438) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.common.xcontent.support.XContentMapValues.nodeBooleanValue(XContentMapValues.java:431) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.TypeParsers.nodeBooleanValue(TypeParsers.java:59) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.TypeParsers.parseField(TypeParsers.java:232) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.KeywordFieldMapper$TypeParser.parse(KeywordFieldMapper.java:124) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.RootObjectMapper.findTemplateBuilder(RootObjectMapper.java:225) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.RootObjectMapper.findTemplateBuilder(RootObjectMapper.java:204) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.createBuilderFromDynamicValue(DocumentParser.java:741) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseDynamicValue(DocumentParser.java:803) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseValue(DocumentParser.java:602) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.innerParseObject(DocumentParser.java:395) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrNested(DocumentParser.java:372) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.internalParseDocument(DocumentParser.java:93) ~[elasticsearch-6.0.0.jar:6.0.0]
        at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:67) ~[elasticsearch-6.0.0.jar:6.0.0]
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 16, 2017, 6:33pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/5 "2017-11-16T18:33:21Z")

</div>

Deleting the index and recreating it fixed the problem. When es creates the index again it uses the new template, whereas when it adds events to the old index it uses the template that existed when the index was created.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2017, 6:33pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982/6 "2017-12-14T18:33:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
