Hi,
I am attempting to index two separate copies of the same log file (different environments) into two separate indexes (one for each environment) and I have in place a mapping template for which through wildcarding matches both but am receving the following issue on attempting to index the data:
illegal_argument_exception", "reason"=>"Mapper for [time] conflicts with existing mapping in other types: [mapper [time] is used by multiple types. Set update_all_types to true to update [format] across all types.]
Here is the Logstash configuration:
input { file { type => "prod" path => [ "//[hostname]/TomcatLogs/ssearch-access.log"] start_position => beginning ignore_older => 0 } file { type => "preprod" path => [ "//[hostname]/TomcatLogs/ssearch-access.log"] start_position => beginning ignore_older => 0 } } filter { csv { columns => [ "time", "username", "searchId", "searchType", "searchString", "status", "took", "hitCount" ] separator => "," } } output { if [type] == "prod" { elasticsearch { index => "ssearch-accesslog-prod-%{+YYYY.MM.dd}" } } if [type] == "preprod" { elasticsearch { index => "ssearch-accesslog-preprod-%{+YYYY.MM.dd}" } } }
And finally the key snippet from the mapping template in place on elasticsearch:
{ "template": "ssearch-accesslog-*", "settings": { "number_of_shards": 1, "number_of_replicas": 0, "index.refresh_interval": "5s" }, "mappings": { "logs": { "properties": { "time": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ss.SSSZ" }, ...
When indexing without a mapping I have no issues. Can someone highlight to me the cause of the issue here?
Thanks,