Hi at all,
From Kibana Console, I have created the following index
PUT riskevents {
"mappings": {
"doc": {
"dynamic_date_formats": ["yyyy-MM-dd'T'HH:mm:ssZ"],
"properties": {
"category": { "type": "keyword" },
"status": { "type": "keyword" },
"appinstance": { "type": "text" },
"appname": { "type": "keyword" },
"createdon": { "type": "text" },
"title": { "type": "text" },
"uri": { "type": "text" },
"realeventtime": { "type": "text" },
"priority": { "type": "text" },
"lastevent": { "type": "text" },
"snapdate": { "type": "text" },
"appinstanceid": { "type": "text" },
"id": { "type": "text" },
"additionalDetails": {
"properties": {
"Details":
{ "type": "nested",
"dynamic": true
}
}
}
}
}
}
}
When i try to import the following document I receive an error
PUT riskevents/doc/1
{
"category": "Security control",
"status": "Open",
"appinstance": "xxx",
"appname": "xxx",
"createdon": "2018-02-20T08:45:38.482Z",
"title": "Password expiration period (in days)",
"uri": "/v1/events/riskevent?eventId=6xx83120-161a-11e8-ax59-23c8d06660e2&applicationInstanceId=xx40411x-1d46-40d5-9c73-fcx8be4e5489",
"realeventtime": "2018-02-20T08:45:38.482Z",
"priority": "High",
"lastevent": "2018-02-20T08:45:38.482Z",
"snapdate": "2018-02-20",
"appinstanceid": "xx40411x-1d46-40d5-9c73-xxd8be9e8689",
"id": "6xx83120-161a-11e8-ax59-23c8x46660x2",
"additionalDetails": [
{
"Details": [
{
"name": "Scan details",
"value": "xxx"
},
{
"name": "Security control name",
"value": "Password expiration period (in days)"
},
{
"name": "Current value",
"value": "60"
},
{
"name": "Recommended value",
"value": "30"
},
{
"name": "Message",
"value": "Non-compliant security setting"
},
{
"name": "Occurred",
"value": "2018-02-20T08:45:38Z"
},
{
"name": "recommendationkey",
"value": "xxx~xxx~xxx"
}
]
}
]
}
This is the error
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "mapper [additionalDetails.Details.value] of different type, current_type [date], merged_type [text]"
}
],
"type": "illegal_argument_exception",
"reason": "mapper [additionalDetails.Details.value] of different type, current_type [date], merged_type [text]"
},
"status": 400
}
Any help would be greatly appreciated