# Index template error

**URL:** <https://discuss.elastic.co/t/index-template-error/120291>\
**Category:** Logstash\
**Created:** [February 17, 2018, 6:40am UTC](https://discuss.elastic.co/t/index-template-error/120291 "2018-02-17T06:40:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [February 17, 2018, 6:40am UTC](https://discuss.elastic.co/t/index-template-error/120291/1 "2018-02-17T06:40:55Z")

</div>

Getting an odd error when attempting to import an index template. Can someone point out where my syntax is wrong? The referenced field appears to be the same as its siblings.

Error message:

> {  
> "error": {  
> "root\_cause": [  
> {  
> "type": "mapper\_parsing\_exception",  
> "reason": "Mapping definition for [email] has unsupported parameters: [spf\_evaluation : {type=text, fields={keyword={type=keyword}}}]"  
> }  
> ],  
> "type": "mapper\_parsing\_exception",  
> "reason": "Failed to parse mapping [_default_]: Mapping definition for [email] has unsupported parameters: [spf\_evaluation : {type=text, fields={keyword={type=keyword}}}]",  
> "caused\_by": {  
> "type": "mapper\_parsing\_exception",  
> "reason": "Mapping definition for [email] has unsupported parameters: [spf\_evaluation : {type=text, fields={keyword={type=keyword}}}]"  
> }  
> },  
> "status": 400  
> }

Section of template referenced by error:

```
			"email": {
				"properties": {
					"count": {
						"type": "long"
					},
					"dkim_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"dmarc_action": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"envelope_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"header_from": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					},
					"source_ip": {
						"type": "ip"
					}
				},
					"spf_evaluation": {
						"type": "text",
						"fields": {
							"keyword": {
								"type": "keyword"
							}
						}
					}
				}
			},

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 8:22pm UTC](https://discuss.elastic.co/t/index-template-error/120291/2 "2018-02-20T20:22:23Z")

</div>

You have an extra closing brace before the spf\_evaluation field so it ends up directly under email instead of under email.properties. That's why the error message complains about email getting an unknown spf\_evaluation parameter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 8:22pm UTC](https://discuss.elastic.co/t/index-template-error/120291/3 "2018-03-20T20:22:26Z")

</div>

Closed on March 20, 2018, 8:22pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.