# Logstash output templating \_id defined twice

**URL:** <https://discuss.elastic.co/t/logstash-output-templating-id-defined-twice/130407>\
**Category:** Logstash\
**Created:** [May 3, 2018, 9:03am UTC](https://discuss.elastic.co/t/logstash-output-templating-id-defined-twice/130407 "2018-05-03T09:03:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\
**Post date:** [May 3, 2018, 9:03am UTC](https://discuss.elastic.co/t/logstash-output-templating-id-defined-twice/130407/1 "2018-05-03T09:03:01Z")

</div>

Hello there

I've recently started using the ELK stack but ran into a problem when using templates to map the types. But when doing that I found the following errors in the logstash logs:

[2018-05-03T10:53:45,201][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"acc\_app\_haproxy-2018.05.03", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x7e7d48ea], :response=\>{"index"=\>{"\_index"=\>"acc\_app\_haproxy-2018.05.03", "\_type"=\>"doc", "\_id"=\>"NXw1JWMB\_gYFHDTjEu5J", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Field [\_id] is defined twice in [doc]"}}}}  
[2018-05-03T10:53:45,201][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"acc\_app\_haproxy-2018.05.03", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x2137a00f], :response=\>{"index"=\>{"\_index"=\>"acc\_app\_haproxy-2018.05.03", "\_type"=\>"doc", "\_id"=\>"MXw1JWMB\_gYFHDTjEu4o", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Field [\_id] is defined twice in [doc]"}}}}  
[2018-05-03T10:53:45,201][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"acc\_app\_haproxy-2018.05.03", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x46ead929], :response=\>{"index"=\>{"\_index"=\>"acc\_app\_haproxy-2018.05.03", "\_type"=\>"doc", "\_id"=\>"NHw1JWMB\_gYFHDTjEu46", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Field [\_id] is defined twice in [doc]"}}}}  
[2018-05-03T10:53:45,202][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"acc\_app\_haproxy-2018.05.03", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x12884733], :response=\>{"index"=\>{"\_index"=\>"acc\_app\_haproxy-2018.05.03", "\_type"=\>"doc", "\_id"=\>"M3w1JWMB\_gYFHDTjEu4w", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Field [\_id] is defined twice in [doc]"}}}}  
[2018-05-03T10:53:45,202][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"acc\_app\_haproxy-2018.05.03", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x261e4ac1], :response=\>{"index"=\>{"\_index"=\>"acc\_app\_haproxy-2018.05.03", "\_type"=\>"doc", "\_id"=\>"Mnw1JWMB\_gYFHDTjEu4q", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Field [\_id] is defined twice in [doc]"}}}}

Template:  
{  
"template": "_\_app\_haproxy_",  
"settings": {  
"index.refresh\_interval": "5s"  
},  
"mappings": {  
"_default_": {  
"dynamic": "false",  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"backend": {  
"type": "keyword"  
},  
"bytes": {  
"type": "integer"  
},  
"concurrentConnectionsBackend": {  
"type": "integer"  
},  
"concurrentConnectionsFrontend": {  
"type": "integer"  
},  
"concurrentConnectionsProcess": {  
"type": "integer"  
},  
"concurrentConnectionsServer": {  
"type": "integer"  
},  
"connectionsBackend": {  
"type": "integer"  
},  
"connectionsServer": {  
"type": "integer"  
},  
"file": {  
"type": "text"  
},  
"frontend": {  
"type": "keyword"  
},  
"host": {  
"type": "keyword"  
},  
"message": {  
"type": "text"  
},  
"port": {  
"type": "integer"  
},  
"request": {  
"type": "text"  
},  
"retries": {  
"type": "integer"  
},  
"server": {  
"type": "keyword"  
},  
"source": {  
"type": "ip"  
},  
"statusCode": {  
"type": "integer"  
},  
"timeClientRequest": {  
"type": "integer"  
},  
"timeQueue": {  
"type": "integer"  
},  
"timeServer": {  
"type": "integer"  
},  
"timeTCP": {  
"type": "integer"  
},  
"timeTotal": {  
"type": "integer"  
},  
"userAgent": {  
"type": "text"  
},  
"verb": {  
"type": "keyword"  
}  
}  
}  
}  
}

And the logstash configuration file (output part is as follows:  
} else if [@metadata][app] == "haproxy" {  
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "%{[@metadata][env]}_app_%{[@metadata][app]}-%{+YYYY.MM.dd}"  
template =\> "/etc/logstash/pipeline/templates/haproxy-logs.json"  
template\_name =\> "haproxy\_logs"  
template\_overwrite =\> true  
}  
}

Before using the templates I didn't have this problem but then I couldn't map the sourceIP to an ip type.

What am I doing wrong?

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2018, 9:03am UTC](https://discuss.elastic.co/t/logstash-output-templating-id-defined-twice/130407/2 "2018-05-31T09:03:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.