Illegal_argument_exception

[jchannon (Jonathan Channon)]

I'm trying to index the below structure via fluentd

We have no indexes so this is the first document.

When sending it to Elastic we get

2018-03-26 13:51:16 +0000 [error]: #0 Could not push log to Elasticsearch: {"took"=>132, "errors"=>true, "items"=>[{"index"=>{"_index"=>"fluentd-20180326", "_type"=>"access_log", "_id"=>"Ng2TYmIBuv17HTvizvlW", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [Exceptions] of different type, current_type [text], merged_type [long]"}}}]}

If our structure doesn't contain the Exception property all is indexed fine

Anyone know why we get this error from Elasticsearch?

[
  "My.SampleApp",
  1522072295,
  {
    "TimeStamp": [
      636576726957471700,
      60
    ],
    "Ticks": 636576690957471700,
    "MsgTmpl": "{@info}",
    "Level": "Error",
    "Exceptions": [
      [
        0,
        null,
        -2147467261,
        "Ooh it broke",
        "sample",
        "   at sample.Program.DoSomethingThatThrows(Logger log)"
      ],
      [
        1,
        null,
        -2147024809,
        "Busted",
        null,
        ""
      ]
    ],
    "info": "LogMessage { RequestId: \"239423049FL\", Component: \"Startup\", Method: \"Configure\", Message: \"There has been an error\" }"
  }
]

[forloop (Russ Cam)]

Sounds like Elasticsearch has inferred the mapping for the Exceptions field to be a long, based upon the first value that it has seen.

Looking at the values in the Exceptions array, the common type to use here would be either text or
keyword (or both, with a multi_field mapping), and let Elasticsearch coerce non-string JSON types to string when indexing.