Filter or output plugin complains: Can't merge a non object mapping with an object mapping

Elastic Stack Logstash
1

Not sure if its the json filter or the elasticsearch output plugin.
But I'm hitting this Logstash error "Can't merge a non object mapping [myMap.1.myList] with an object mapping [myMap.1.myList]"

Logstash error:

{:timestamp=>"2016-04-07T10:50:56.952000+0000", :message=>"Failed action. ", :status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2016.04.07", :_type=>"jsonlog", :_routing=>nil}, 2016-04-07T10:50:56.189Z MYHOST 
{"timestamp":"2016-04-07 10:50:55,562","level":"INFO","logger":"com.mycompany.MyClass","thread":"ListenerThread-1","object":"MyEvent","myMap":{"1":{"myList":["string1","\u30A4t\u30F2rk.\u30AB\u30F3\u30E8\u30A6\u30C6"]}}}], 
:response=>{"create"=>{"_index"=>"logstash-2016.04.07", "_type"=>"jsonlog", "_id"=>"AVPwWK2zIXtUygpTeLqZ", "status"=>400, 
"error"=>{"type"=>"illegal_argument_exception", "reason"=>"Can't merge a non object mapping [myMap.1.myList] with an object mapping [myMap.1.myList]"}}}, :level=>:warn}

My Logstash config:

input {
    courier {
        ...
    }
}

filter {

    if [type] in ["jsonlog"] {
        json {
            source => "message"
        }
    }

}

output {
    elasticsearch {
        ...
    }
}

logstash version 2.3.0-1
elasticsearch version 2.3.0

I tried upgrade to elasticsearch version 2.3.1 and I'm hitting a slightly different error with the same json map entry:
"object mapping for [myMap.1.myList] tried to parse field [null] as object, but found a concrete value

2

The error message comes from Elasticsearch (the service, not the plugin). The field myMap.1.myList has been indexed by Elasticsearch and mapped as an object (I think) but now you're trying to index a document where that field is a string (actually an array of strings). Either fix your document to match the mapping in ES or reindex the data so that its mapping matches your data.

1 Like