Malformed [mappings] section for type [dynamic_templates],

Elastic Stack Elasticsearch
1

Hello I am trying to add the following mapping to my index
ELK 6.8.0

PUT _template/logstash-*
{
  "template" : "logstash-*",
  "version" : 60001,
  "settings" : {
    "index.refresh_interval" : "5s",
    "index.number_of_shards" : "1",
    "index.number_of_replicas" : "0",
    "index.mapping.total_fields.limit": "2000"
  },
  "mappings" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "ignore_above": 256 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date"},
        "@version": { "type": "keyword"},
        "geoip"  : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        }
      }
    }
  }

and I Keep on getting the following error

        {
          "error": {
            "root_cause": [
              {
                "type": "illegal_argument_exception",
                "reason": "Malformed [mappings] section for type [dynamic_templates], should include an inner object describing the mapping"
              }
            ],
            "type": "illegal_argument_exception",
            "reason": "Malformed [mappings] section for type [dynamic_templates], should include an inner object describing the mapping"
          },
          "status": 400
        }

image

2

It looks like a template for 7.x as there is no type name in it.
If you're starting a project I'd recommend going to 7.2.0 instead.
Otherwise add the type name "_doc" (look at the 6.8 documentation about index templates).

1 Like
3

Thank you :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.