I cannot update template

Elastic Stack Elasticsearch
1

I updated the template of filebeat in the elasticsearch node. It returned me an error:

{
	"error": {
		"root_cause": [
			{
				"type": "mapper_parsing_exception",
				"reason": "Root mapping definition has unsupported parameters:  [_default_ : {dynamic_templates=[{template1={mapping={ignore_above=1024, index=not_analyzed, type={dynamic_type}, doc_values=true}, match=*}}], _all={norms={enabled=false}, enabled=true}, properties={@timestamp={type=date}, geoip={dynamic=true, properties={ip={type=ip}, latitude={type=half_float}, location={type=geo_point}, longitude={type=half_float}}}, offset={type=long, doc_values=true}, message={index=analyzed, type=string}}}]"
			}
		],
		"type": "mapper_parsing_exception",
		"reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:  [_default_ : {dynamic_templates=[{template1={mapping={ignore_above=1024, index=not_analyzed, type={dynamic_type}, doc_values=true}, match=*}}], _all={norms={enabled=false}, enabled=true}, properties={@timestamp={type=date}, geoip={dynamic=true, properties={ip={type=ip}, latitude={type=half_float}, location={type=geo_point}, longitude={type=half_float}}}, offset={type=long, doc_values=true}, message={index=analyzed, type=string}}}]",
		"caused_by": {
			"type": "mapper_parsing_exception",
			"reason": "Root mapping definition has unsupported parameters:  [_default_ : {dynamic_templates=[{template1={mapping={ignore_above=1024, index=not_analyzed, type={dynamic_type}, doc_values=true}, match=*}}], _all={norms={enabled=false}, enabled=true}, properties={@timestamp={type=date}, geoip={dynamic=true, properties={ip={type=ip}, latitude={type=half_float}, location={type=geo_point}, longitude={type=half_float}}}, offset={type=long, doc_values=true}, message={index=analyzed, type=string}}}]"
		}
	},
	"status": 400
}

Here is my template file:

{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip"  : {
          "dynamic": "true",
          "properties" : {
	         "ip": { "type": "ip" },
	         "latitude" : { "type" : "half_float" },
	         "longitude" : { "type" : "half_float" },
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-7.14.1*"
}

I used curl to update:

curl -X PUT -H 'Content-Type: application/json' 'http://localhost:9200/_template/filebeat-7.14.1' -d @filebeat-index-template.json

Please help me to check why it was wrong.
Thanks

2

I could be way off here, and don't know your use case, but here are some thoughts:

Doesn't seem to do much and can probably be safely removed.

Type string isn't a thing try either "text" or "keyword" depending upon use case.
Index should be either "true" or "false".
Once those changes are made I get that template loading in just fine.

{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text",
        "index": "true"
      },
      "offset": {
        "type": "long",
        "doc_values": "true"
      },
      "geoip": {
        "dynamic": "true",
        "properties": {
          "ip": {
            "type": "ip"
          },
          "latitude": {
            "type": "half_float"
          },
          "longitude": {
            "type": "half_float"
          },
          "location": {
            "type": "geo_point"
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-7.14.1*"
}```
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.