How to alter GET /index/_mapping output to work with PUT /index/_mapping

Elastic Stack Elasticsearch
1

I am upgrading elasticsearch from 2.x to 7.x. I am trying to re-add index mappings from 2.x. I want to know how to alter a mapping to make it compatible with 7.x.

Here is the result of GET /syslog/_mapping from 2.x

{
	"syslog": {
		"mappings": {
			"syslog": {
				"properties": {
					"@timestamp": {
						"type": "date",
						"format": "dateOptionalTime"
					},
					"@version": {
						"type": "string"
					},
					"_index": {
						"type": "string"
					},
					"_type": {
						"type": "string"
					},
					"file": {
						"type": "string"
					},
					"host": {
						"type": "string"
					},
					"message": {
						"type": "string"
					},
					"offset": {
						"type": "string"
					},
					"received_at": {
						"type": "date",
						"format": "dateOptionalTime"
					},
					"received_from": {
						"type": "string"
					},
					"syslog_facility": {
						"type": "string"
					},
					"syslog_facility_code": {
						"type": "long"
					},
					"syslog_hostname": {
						"type": "string"
					},
					"syslog_message": {
						"type": "string"
					},
					"syslog_pid": {
						"type": "string"
					},
					"syslog_program": {
						"type": "string"
					},
					"syslog_severity": {
						"type": "string"
					},
					"syslog_severity_code": {
						"type": "long"
					},
					"syslog_timestamp": {
						"type": "string"
					}
				}
			}
		}
	}
}

I try adding adding the mapping by doing this in 7.6

PUT /syslog/_mapping
{
	"syslog": {
		"mappings": {
			"syslog": {
				"properties": {
					"@timestamp": {
						"type": "date",
						"format": "dateOptionalTime"
					},
					"@version": {
						"type": "string"
					},
					"_index": {
						"type": "string"
					},
					"_type": {
						"type": "string"
					},
					"file": {
						"type": "string"
					},
					"host": {
						"type": "string"
					},
					"message": {
						"type": "string"
					},
					"offset": {
						"type": "string"
					},
					"received_at": {
						"type": "date",
						"format": "dateOptionalTime"
					},
					"received_from": {
						"type": "string"
					},
					"syslog_facility": {
						"type": "string"
					},
					"syslog_facility_code": {
						"type": "long"
					},
					"syslog_hostname": {
						"type": "string"
					},
					"syslog_message": {
						"type": "string"
					},
					"syslog_pid": {
						"type": "string"
					},
					"syslog_program": {
						"type": "string"
					},
					"syslog_severity": {
						"type": "string"
					},
					"syslog_severity_code": {
						"type": "long"
					},
					"syslog_timestamp": {
						"type": "string"
					}
				}
			}
		}
	}
}

But I get the following error

{
  "error" : {
    "root_cause" : [
      {
        "type" : "mapper_parsing_exception",
        "reason" : "Root mapping definition has unsupported parameters:  [syslog : {mappings={syslog={properties={syslog_pid={type=string}, syslog_severity_code={type=long}, _index={type=string}, offset={type=string}, syslog_facility={type=string}, _type={type=string}, syslog_facility_code={type=long}, syslog_program={type=string}, message={type=string}, syslog_message={type=string}, syslog_severity={type=string}, received_from={type=string}, @timestamp={format=dateOptionalTime, type=date}, file={type=string}, syslog_hostname={type=string}, received_at={format=dateOptionalTime, type=date}, syslog_timestamp={type=string}, @version={type=string}, host={type=string}}}}}]"
      }
    ],
    "type" : "mapper_parsing_exception",
    "reason" : "Root mapping definition has unsupported parameters:  [syslog : {mappings={syslog={properties={syslog_pid={type=string}, syslog_severity_code={type=long}, _index={type=string}, offset={type=string}, syslog_facility={type=string}, _type={type=string}, syslog_facility_code={type=long}, syslog_program={type=string}, message={type=string}, syslog_message={type=string}, syslog_severity={type=string}, received_from={type=string}, @timestamp={format=dateOptionalTime, type=date}, file={type=string}, syslog_hostname={type=string}, received_at={format=dateOptionalTime, type=date}, syslog_timestamp={type=string}, @version={type=string}, host={type=string}}}}}]"
  },
  "status" : 400
}

It does not tell me what the unsupported parameters are (and instead lists everything). Which parameters are not supported? How can I format it correctly so that is is accepted by the mapping API?

2

The JSON structure has been changed over the years, and you need to change yours in order to work with Elasticsearch 7 here.

3

I have tried to match what I found here https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html

but I still get the same error using this updated JSON

PUT /syslog/_mapping
{
	"mappings": {
		"properties": {
			"@timestamp": {
				"type": "date",
				"format": "dateOptionalTime"
			},
			"@version": {
				"type": "string"
			},
			"_index": {
				"type": "string"
			},
			"_type": {
				"type": "string"
			},
			"file": {
				"type": "string"
			},
			"host": {
				"type": "string"
			},
			"message": {
				"type": "string"
			},
			"offset": {
				"type": "string"
			},
			"received_at": {
				"type": "date",
				"format": "dateOptionalTime"
			},
			"received_from": {
				"type": "string"
			},
			"syslog_facility": {
				"type": "string"
			},
			"syslog_facility_code": {
				"type": "long"
			},
			"syslog_hostname": {
				"type": "string"
			},
			"syslog_message": {
				"type": "string"
			},
			"syslog_pid": {
				"type": "string"
			},
			"syslog_program": {
				"type": "string"
			},
			"syslog_severity": {
				"type": "string"
			},
			"syslog_severity_code": {
				"type": "long"
			},
			"syslog_timestamp": {
				"type": "string"
			}
		}
	}
}

Because the error is unhelpful I am unable to solve this. I don't know if it is a bad property, bad JSON, or anything else. Please let me know what the error is with my mapping statement as I am unable to figure it out from the error elasticsearch gives and the docs.

4

According to the Put Mapping API docs a put-mapping request looks like this:

PUT /syslog/_mapping
{
  "properties": {
     ...
  }
}

Yours looks different:

PUT /syslog/_mapping
{
  "mappings": {
    "properties": {
      ...
    }
  }
}

The error message says Root mapping definition has unsupported parameters: [mappings : {properties ... which tells you that the mappings key is indeed unexpected here.

5

Thank you! I am getting errors I can look up now, so progress is being made. I was mistakenly focused on this part of the docs since it was closest to the older formulation https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html#add-multi-fields-existing-field-ex

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.