Failing to Create Mappings Logstash/Elasticsearch

Elastic Stack Elasticsearch
1

I'm experiencing a problem where I'm trying to create new mappings for the indexed data, but I receive an error:

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [request] conflicts with existing mapping in other types:\n[mapper [request] has different [index] values, mapper [request] has different [doc_values] values, cannot change from disabled to enabled, mapper [request] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [request] conflicts with existing mapping in other types:\n[mapper [request] has different [index] values, mapper [request] has different [doc_values] values, cannot change from disabled to enabled, mapper [request] has different [analyzer]]"
   },
   "status": 400
}

I need to reindex, however, the data was thrown into elasticserach with the elasticserach logstash plugin... I used something like this to parse the nginx log.

At the very least I need the request field index type to be not_analyzed. Is there a way to index the data appropriately with logstash without needing to send a PUT request after the data is indexed. If not, how can I reindex the data which the elasticsearch logstash plugin output?

2

Use index templates to set certain mappings for all new indexes whose name match a pattern. In this you need to make a copy of Logstash's original index template and modify it so the request field isn't analyzed. You'll also have to modify the index name pattern so it matches your actual index name. The default pattern assumes that the index name matches logstash-*.

I note that your log index name doesn't include the date, i.e. the index will grow and grow indefinitely. That's not a good idea. Stick with time-series indexes.

3

Or is there a way to tell the client to search all logstash-* indices? Maybe I can query aliases?

4

Or is there a way to tell the client to search all logstash-* indices?

Yes; see Multi-target syntax | Elasticsearch Guide [8.11] | Elastic.

Maybe I can query aliases?

That too.