Getting "Mixing up field types" for keyword

[Badger]

In Logstash I am parsing a field out of a line using %{NOTSPACE:xxhttpversion} . That field is going to be HTTP/1.1 (or maybe HTTP/1.0), so I do not need it analyzed. So in my template (applied after a copy of the default logstash template with the template name changed) I tried to tell ES that it should be a keyword.

{
"template" : "iis2-*",
"order" : 10,
"version" : 6,
"mappings" : {
"whatever": {
"properties": { [...] "xxhttpversion": { "type": "keyword" }, [...]
}
}
}

This causes logstash to reject the record with "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Mixing up field types: class org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType != class org.elasticsearch.index.mapper.KeywordFieldMapper$KeywordFieldType on field xxhttpversion"}

Is there a way to do this? ES 5.3.2, btw.

I tried "xxhttpversion": { "type": "keyword", "analyzer": "keyword" }, in the mappings properties of the template and cannot even PUT that ("reason": "Mapping definition for [xxhttpversion] has unsupported parameters: [analyzer : keyword]")

[Badger]

I now realize that although logstash is logging the error, it is just reporting what Elasticsearch told it, so this is really an ES issue. When it does not affect the mapper it is possible to change the type by adding a property in the mappings in a template used in addition to the logstash template, for keyword that does not work.

What does work is taking a copy of the logstash template and adding an entry into the array of dynamic template, before the string_fields entry - { "httpversion": { "path_match": "httpversion", "mapping": { "type": "keyword" } } },