Index template error

Elastic Stack Logstash
1

Getting an odd error when attempting to import an index template. Can someone point out where my syntax is wrong? The referenced field appears to be the same as its siblings.

Error message:

{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [default]: Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [email] has unsupported parameters: [spf_evaluation : {type=text, fields={keyword={type=keyword}}}]"
}
},
"status": 400
}

Section of template referenced by error:

			"email": {
				"properties": {
					"count": {
						"type": "long"
					},
					"dkim_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"dmarc_action": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"envelope_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"header_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"source_ip": {
						"type": "ip"
					}
				},
					"spf_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					}
				}
			},
2

You have an extra closing brace before the spf_evaluation field so it ends up directly under email instead of under email.properties. That's why the error message complains about email getting an unknown spf_evaluation parameter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.