Index template error

[wwalker (Walker)]

Getting an odd error when attempting to import an index template. Can someone point out where my syntax is wrong? The referenced field appears to be the same as its siblings.

Error message:

{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [default]: Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]"
}
},
"status": 400
}

Section of template referenced by error:

			"email": {
				"properties": {
					"count": {
						"type": "long"
					},
					"dkim_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"dmarc_action": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"envelope_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"header_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"source_ip": {
						"type": "ip"
					}
				},
					"spf_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					}
				}
			},

[magnusbaeck (Magnus Bäck)]

You have an extra closing brace before the spf_evaluation field so it ends up directly under email instead of under email.properties. That's why the error message complains about email getting an unknown spf_evaluation parameter.