How to properly use Mappings?

Elastic Stack Elasticsearch
1

Hi,

I use logstash to feed data into elasticsearch. I am processing error logs and I have a field called SEVERITY that can take up just a few values (all strings). So I'd like this field not to be analyzed. I gathered that if I create an index first it [ie. the SEVERITY field] will be analyzed by default. If I add an index template first, however, and feed data in afterwards I get the following exception from elasticsearch:

MapperParsingException[Failed to parse mapping [SEVERITY]: Root mapping definition has unsupported parameters: [index : not_analyzed] [type : string]];

My index template is the following:

[INSTBASE=devl]$ curl -XGET 'localhost:9200/_template/app_errors_default?pretty'
{
  "app_errors_default" : {
    "order" : 0,
    "template" : "app_errors_*",
    "settings" : { },
    "mappings" : {
      "SEVERITY" : {
        "index" : "not_analyzed",
        "type" : "string"
      }
    },
    "aliases" : { }
  }
}

(Please note, that I have not attempted to create the index manually.)

What I am missing here?

2

Hi,
under mappings you need to have the name of the type, then properties and then the actual top-level fields (e.g. SEVERITY).

The error mentions root mapping, meaning that it considers SEVERITY the name of your type, and it says that index and type are not supported properties at that level.

Have a look at an example here.

Cheers
Luca