Illegal_argument_exception mapper

Elastic Stack Elasticsearch
1

Hi at all,

From Kibana Console, I have created the following index

PUT riskevents {
	"mappings": {
		"doc": {
		"dynamic_date_formats": ["yyyy-MM-dd'T'HH:mm:ssZ"],
			"properties": {
				"category": { "type": "keyword" },
				"status": { "type": "keyword" },
				"appinstance": { "type": "text" },
				"appname": { "type": "keyword" },
				"createdon": { "type": "text" },
				"title": { "type": "text" },
				"uri": { "type": "text" },
				"realeventtime": { "type": "text" },
				"priority": { "type": "text" },
				"lastevent": { "type": "text" },
				"snapdate": { "type": "text" },
				"appinstanceid": { "type": "text" },
				"id": { "type": "text" },
				"additionalDetails": {
						"properties": {
						"Details": 
						    { "type": "nested",
						      "dynamic": true
						    }
						}
            }
          }
        }
      }
    }

When i try to import the following document I receive an error

PUT riskevents/doc/1
{
            "category": "Security control", 
            "status": "Open", 
            "appinstance": "xxx", 
            "appname": "xxx", 
            "createdon": "2018-02-20T08:45:38.482Z", 
            "title": "Password expiration period (in days)", 
            "uri": "/v1/events/riskevent?eventId=6xx83120-161a-11e8-ax59-23c8d06660e2&applicationInstanceId=xx40411x-1d46-40d5-9c73-fcx8be4e5489", 
            "realeventtime": "2018-02-20T08:45:38.482Z", 
            "priority": "High", 
            "lastevent": "2018-02-20T08:45:38.482Z", 
            "snapdate": "2018-02-20", 
            "appinstanceid": "xx40411x-1d46-40d5-9c73-xxd8be9e8689", 
            "id": "6xx83120-161a-11e8-ax59-23c8x46660x2", 
            "additionalDetails": [
                {
                    "Details": [
                        {
                            "name": "Scan details", 
                            "value": "xxx"
                        }, 
                        {
                            "name": "Security control name", 
                            "value": "Password expiration period (in days)"
                        }, 
                        {
                            "name": "Current value", 
                            "value": "60"
                        }, 
                        {
                            "name": "Recommended value", 
                            "value": "30"
                        }, 
                        {
                            "name": "Message", 
                            "value": "Non-compliant security setting"
                        }, 
                        {
                            "name": "Occurred", 
                            "value": "2018-02-20T08:45:38Z"
                        }, 
                        {
                            "name": "recommendationkey", 
                            "value": "xxx~xxx~xxx"
                        }
                    ]
                }
            ]
        }

This is the error

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "mapper [additionalDetails.Details.value] of different type, current_type [date], merged_type [text]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "mapper [additionalDetails.Details.value] of different type, current_type [date], merged_type [text]"
  },
  "status": 400
}

Any help would be greatly appreciated

2

You need to force in the mapping the type for the value field to be a text data type.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.