# Failover Mapping

**URL:** <https://discuss.elastic.co/t/failover-mapping/219024>\
**Category:** Elasticsearch\
**Created:** [February 12, 2020, 3:17pm UTC](https://discuss.elastic.co/t/failover-mapping/219024 "2020-02-12T15:17:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [February 12, 2020, 3:17pm UTC](https://discuss.elastic.co/t/failover-mapping/219024/1 "2020-02-12T15:17:43Z")

</div>

Hey, we are using elasticsearch primarily to index our logging data. Unfortunaley due to the many systems we are maintaining, we can't really guarantee that every "device" is logging it's events the same way.

For example: We are using the fieldname 'srcip' in every event which contains a source ip address. In our elasticsearch cluster I've created a static mapping for this field to parse it as "ip". Thats perfect for 99% of our logevents. Unfortunately our windows events which we are indexing by using:

nxlog \> syslog-ng (to hdd) \> logstash json parser (from hdd) \> elasticsearch

do not always contain an IP address even if it has been added by windows. Sometimes it is only a dash '-' and if that is the case elasticsearch is logging an error and the document is not indexed. Like so:

```
"stacktrace": ["org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [srcip] of type [ip] in document with id 'F9_XOXABfPOu07_eHMGA'. Preview of field's value: '-'"

```

So my question is, if it is possible to define a kind of "failover mapping". So a solution for the above example would be, that the content of srcip ("-") should be indexed as string in case the ip field mapper fails.

PS: The same problem applies to several other sources were we are collecting logdata. Windows was only a example.

---

<div class="post-metadata">

**Author:** ![Armin\_Braun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armin_braun/32/20092_2.png) [@Armin\_Braun](https://discuss.elastic.co/u/Armin_Braun)\
**Post date:** [February 12, 2020, 4:58pm UTC](https://discuss.elastic.co/t/failover-mapping/219024/2 "2020-02-12T16:58:00Z")

</div>

Hi @tomx1,

You can't fail over to another type but you can use ignore\_malformed to make the event index properly for its other fields. See [https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-malformed.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-malformed.html)

You will still have the contents of the broken field in the source if you need to inspect it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 4:58pm UTC](https://discuss.elastic.co/t/failover-mapping/219024/3 "2020-03-11T16:58:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.