Getting Type Error but not setting a Type

Elastic Stack Logstash
1
  1. I've read the issues, solutions and blog article about removal of type fields
  2. I am NOT SETTING A TYPE FIELD but still get a type error
  3. I have a geo_point type which I must create using an index template

The following no longer works
STEP 1: Create index template to create geo_point field (returns "success")
STEP 2: Ingest using Logstash CONF file

ERROR: final mapping would have more than 1 type: [doc, map]"}

INDEX TEMPLATE

"greg-test": {
"order": 0,
"index_patterns": [
"greg*",
"gre*"
],
"settings": {
"index": {
"number_of_shards": "1"
}
},
"mappings": {
"map": {
"_source": {
"enabled": false
},
"properties": {
"host_name": {
"type": "keyword"
},
"lid_location": {
"type": "geo_point"
}
}
}
},
"aliases": {}
}
}

CONF FILE

Output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "greg-test" }}

2

In your template you have created a type map, but since you are not setting a type on the output, the document_type will default to doc. So you have two types, which is a problem.

I think you can fix this either by changing the mapping name in the template to doc (and creating a new index) or using the (deprecated) document_type setting on the output.

3

thank you. corrected. same error even after correction. see below. All I need to know is this....what's the minimum example of an index template that sets a single field as geo_point?

(Why can't logstash set a geo_point field in the conf file via mutate option?)

HERE IS MY FAILED TEMPLATE
Error message..."Rejecting mapping update to [geo-test] as the final mapping would have more than 1 type: [geo-test, doc]"

{
"geo-test": {
"order": 0,
"index_patterns": [
"geo-test"
],
"settings": {},
"mappings": {
"doc": {
"properties": {
"lid_location": {
"type": "geo_point"
}
}
}
},
"aliases": {}
}
}

4

What operation resulted in the error message quoted above?

5

How about this? Using match is a weird way to do it, but it was the simplest working example I had handy.

{
  "order": 0,
  "version": 3,
  "template": "nypd-complaints",
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "locations": { 
            "match": "geolocation",
            "mapping": { "type": "geo_point" }
          }
        }
      ]
    }
  }
}

Which gets me a geo_point

AA1

6

Operation generating the error was Logstash CSV filter...so Magnus will Logstash be able to simply set a field as geo_point without using an index template to set a field as geo_point?

7

Operation generating the error was Logstash CSV filter...

No, that's not what I meant. Are you saying that it's when Logstash posts to Elasticsearch that you get the error? Please always quote error messages in full.

so Magnus will Logstash be able to simply set a field as geo_point without using an index template to set a field as geo_point?

No. The index needs to be configured (via explicit mappings) that a particular field is a geo_point field. This can be done via an index template, via mappings provided when the index is created, or via the put mapping API.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.