# Help with mapping update **URL:** https://discuss.elastic.co/t/help-with-mapping-update/22875 **Category:** Elasticsearch **Created:** [March 24, 2015, 9:28pm UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875 "2015-03-24T21:28:37Z") **Posts on this page:** 8 **Page:** 1
### Author: ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner) #### Post date: [March 24, 2015, 9:28pm UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/1 "2015-03-24T21:28:37Z")
Greetings, I am trying to update mapping to make certain fields not\_analyzed. The index gets created from default template, now I'm trying to add the following mapping to it (long) and get an error. The index is empty. I'm probably missing something very obvious. Thank you, David ======== $ curl -XPUT localhost:9200/backend/mytype/\_mapping -d mytype\_mapping.json {"error":"RemoteTransportException[[XXXX / Luis Buñuel][inet[/10.XX.XX.XX:9333]][indices:admin/mapping/put]]; nested: NullPointerException; ","status":500}(dk)dk- ======== updated mapping: { "mappings" : { {"mytype" : { "\_ttl" : { "enabled" : true, "default" : 172800000 }, "properties" : { "@timestamp" : { "type" : "date", "format" : "dateOptionalTime" }, "@version" : { "type" : "string" }, "file" : { "type" : "string" }, "host" : { "type" : "string" }, "json" : { "properties" : { "XXXX.buffer.size" : { "type" : "long" }, "action" : { "type" : "string","index" : "not\_analyzed" }, [....] -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm) #### Post date: [March 24, 2015, 10:44pm UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/2 "2015-03-24T22:44:16Z")
Try deleting the index and recreating using the updated mapping? Also as a suggestion, avoid using TTL, it's very resource intensive and if you are using time based data then you should use time based indices. On 25 March 2015 at 08:28, David Kleiner [david.kleiner@gmail.com](mailto:david.kleiner@gmail.com) wrote: > Greetings, > > I am trying to update mapping to make certain fields not\_analyzed. The > index gets created from default template, now I'm trying to add the > following mapping to it (long) and get an error. The index is empty. > > I'm probably missing something very obvious. > > Thank you, > > David > > ======== > > $ curl -XPUT localhost:9200/backend/mytype/\_mapping -d mytype\_mapping.json > {"error":"RemoteTransportException[[XXXX / Luis > Buñuel][inet[/10.XX.XX.XX:9333]][indices:admin/mapping/put]]; nested: > NullPointerException; ","status":500}(dk)dk- > > ======== > > updated mapping: > { > "mappings" : { > > {"mytype" : { > "\_ttl" : { > "enabled" : true, > "default" : 172800000 > }, > "properties" : { > "@timestamp" : { > "type" : "date", > "format" : "dateOptionalTime" > }, > "@version" : { > "type" : "string" > }, > "file" : { > "type" : "string" > }, > "host" : { > "type" : "string" > }, > "json" : { > "properties" : { > "XXXX.buffer.size" : { > "type" : "long" > }, > "action" : { > "type" : "string","index" : "not\_analyzed" > }, > > [....] > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X8rkdzDc-VXV1wx%2BoXBPAiAnoiHf6AkAETXYFc1Rvi8jg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X8rkdzDc-VXV1wx%2BoXBPAiAnoiHf6AkAETXYFc1Rvi8jg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner) #### Post date: [March 24, 2015, 11:10pm UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/3 "2015-03-24T23:10:39Z")
Thank you Mark, I'll keep trying, will also try elasticdump to load custom mapping or play with templates. Cheers, David On Tuesday, March 24, 2015 at 3:44:55 PM UTC-7, Mark Walkom wrote: > Try deleting the index and recreating using the updated mapping? > > Also as a suggestion, avoid using TTL, it's very resource intensive and if > you are using time based data then you should use time based indices. > > On 25 March 2015 at 08:28, David Kleiner \<[david....@gmail.com](mailto:david....@gmail.com) > \\> wrote: > > > Greetings, > > > > I am trying to update mapping to make certain fields not\_analyzed. The > > index gets created from default template, now I'm trying to add the > > following mapping to it (long) and get an error. The index is empty. > > > > I'm probably missing something very obvious. > > > > Thank you, > > > > David > > > > ======== > > > > $ curl -XPUT localhost:9200/backend/mytype/\_mapping -d mytype\_mapping.json > > {"error":"RemoteTransportException[[XXXX / Luis > > Buñuel][inet[/10.XX.XX.XX:9333]][indices:admin/mapping/put]]; nested: > > NullPointerException; ","status":500}(dk)dk- > > > > ======== > > > > updated mapping: > > { > > "mappings" : { > > > > {"mytype" : { > > "\_ttl" : { > > "enabled" : true, > > "default" : 172800000 > > }, > > "properties" : { > > "@timestamp" : { > > "type" : "date", > > "format" : "dateOptionalTime" > > }, > > "@version" : { > > "type" : "string" > > }, > > "file" : { > > "type" : "string" > > }, > > "host" : { > > "type" : "string" > > }, > > "json" : { > > "properties" : { > > "XXXX.buffer.size" : { > > "type" : "long" > > }, > > "action" : { > > "type" : "string","index" : "not\_analyzed" > > }, > > > > [....] > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/6222b24f-7cf1-42ea-a0e6-68b52c4e9e76%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7ffd5cda-ca1f-443e-b476-27f1d3765c1f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7ffd5cda-ca1f-443e-b476-27f1d3765c1f%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner) #### Post date: [March 24, 2015, 11:36pm UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/4 "2015-03-24T23:36:05Z")
I got the index template to work, turns out it's really straightforward. I now do have .raw fields and all the world is green. I'll add the template to my other index so it gets geoip mapping when I roll to April. Cheers, David On Tuesday, March 24, 2015 at 2:28:38 PM UTC-7, David Kleiner wrote: > Greetings, > > I am trying to update mapping to make certain fields not\_analyzed. The > index gets created from default template, now I'm trying to add the > following mapping to it (long) and get an error. The index is empty. > > I'm probably missing something very obvious. > > Thank you, > > David > > ======== > > $ curl -XPUT localhost:9200/backend/mytype/\_mapping -d mytype\_mapping.json > {"error":"RemoteTransportException[[XXXX / Luis > Buñuel][inet[/10.XX.XX.XX:9333]][indices:admin/mapping/put]]; nested: > NullPointerException; ","status":500}(dk)dk- > > ======== > > updated mapping: > { > "mappings" : { > > {"mytype" : { > "\_ttl" : { > "enabled" : true, > "default" : 172800000 > }, > "properties" : { > "@timestamp" : { > "type" : "date", > "format" : "dateOptionalTime" > }, > "@version" : { > "type" : "string" > }, > "file" : { > "type" : "string" > }, > "host" : { > "type" : "string" > }, > "json" : { > "properties" : { > "XXXX.buffer.size" : { > "type" : "long" > }, > "action" : { > "type" : "string","index" : "not\_analyzed" > }, > > [....] -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4114d717-ae65-493f-8f7f-c2cec8567e2a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4114d717-ae65-493f-8f7f-c2cec8567e2a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner) #### Post date: [March 25, 2015, 12:06am UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/5 "2015-03-25T00:06:56Z")
My confusion just leveled-up 🙂 So the mapping is updated, all string fields now have .raw copies but I don't see them in Kibana. Perhaps my understanding of this mechanism is incomplete and I need to manually copy fields to their .raw counterparts in logstash so that ES query returns documents with .raw fields in them.. And I did remove the TTL so my cluster is happy again. On Tuesday, March 24, 2015 at 4:36:05 PM UTC-7, David Kleiner wrote: > I got the index template to work, turns out it's really straightforward. I > now do have .raw fields and all the world is green. > > I'll add the template to my other index so it gets geoip mapping when I > roll to April. > > Cheers, > > David > > [trimmed] -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm) #### Post date: [March 25, 2015, 12:48am UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/6 "2015-03-25T00:48:32Z")
Are you using KB4 or 3? If 4 then you need to refresh the fields under the index settings. On 25 March 2015 at 11:06, David Kleiner [david.kleiner@gmail.com](mailto:david.kleiner@gmail.com) wrote: > My confusion just leveled-up 🙂 > > So the mapping is updated, all string fields now have .raw copies but I > don't see them in Kibana. Perhaps my understanding of this mechanism is > incomplete and I need to manually copy fields to their .raw counterparts in > logstash so that ES query returns documents with .raw fields in them.. > > And I did remove the TTL so my cluster is happy again. > > On Tuesday, March 24, 2015 at 4:36:05 PM UTC-7, David Kleiner wrote: > > > I got the index template to work, turns out it's really straightforward. > > I now do have .raw fields and all the world is green. > > > > I'll add the template to my other index so it gets geoip mapping when I > > roll to April. > > > > Cheers, > > > > David > > > > [trimmed] > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X93PAVFmAfjODzhD93Hn3XJCKuuyco4NU5vXczc3aGyhg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X93PAVFmAfjODzhD93Hn3XJCKuuyco4NU5vXczc3aGyhg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner) #### Post date: [March 25, 2015, 12:52am UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/7 "2015-03-25T00:52:36Z")
Indeed, it just works in 4! Thank you again, David On Tuesday, March 24, 2015 at 5:49:16 PM UTC-7, Mark Walkom wrote: > Are you using KB4 or 3? > If 4 then you need to refresh the fields under the index settings. > > On 25 March 2015 at 11:06, David Kleiner \<[david....@gmail.com](mailto:david....@gmail.com) > \\> wrote: > > > My confusion just leveled-up 🙂 > > > > So the mapping is updated, all string fields now have .raw copies but I > > don't see them in Kibana. Perhaps my understanding of this mechanism is > > incomplete and I need to manually copy fields to their .raw counterparts in > > logstash so that ES query returns documents with .raw fields in them.. > > > > And I did remove the TTL so my cluster is happy again. > > > > On Tuesday, March 24, 2015 at 4:36:05 PM UTC-7, David Kleiner wrote: > > > > > I got the index template to work, turns out it's really straightforward. > > > I now do have .raw fields and all the world is green. > > > > > > I'll add the template to my other index so it gets geoip mapping when I > > > roll to April. > > > > > > Cheers, > > > > > > David > > > > > > [trimmed] > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e09155d6-42fd-4342-a53e-201e3f638038%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/14929de4-fce5-4a49-aaa3-ebda189632b7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/14929de4-fce5-4a49-aaa3-ebda189632b7%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [July 6, 2017, 12:24am UTC](https://discuss.elastic.co/t/help-with-mapping-update/22875/8 "2017-07-06T00:24:15Z")