Mapper field type being changed by something

Elastic Stack Logstash
1

Hi Everyone,

I'm pretty new to new to ELK and i've made a mapper "location" which is a geo_point type so I can pass my lat and long data to it.

This is how I've mapped it

`PUT my_index
{
  "mappings": {
    "location": {
      "properties": {
        "location": {
          "type": "geo_point"
        }
      }
    }
  }
}`

It seems to be taking inputs correctly but I get this weird error(with picture of error message below)

"reason=>{"create"=>{"index"=>"logstash-2016.02.10v8", "type"=>"logs", "__id"=>"AVLOr7VExrrwFF6j5zLP", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [location] cannot be changed from type [geo_point] to [long]"}}}, :level=>:warn}

elasticsearch support ticket3.png1403×81 7.62 KB

It seems like something is trying to change location's type and I have nothing in my configuration file that does that. I'm curious how I can stop this from happening/identify what is attempting to change "mapper [location]"

here is my confg

`filter {
  mutate {
      convert => { "lat" => "float" }
      convert => { "lon" => "float" }
      add_field => { "location" => "%{lat}" }
      add_field => { "location" => "%{lon}" }
      }

  geoip {
    source => "geoip.ip"
    add_field => { "geoip_location" => "%{lat}" }
    add_field => { "geoip_location" => "%{lon}" }
  }

   grok {
     # match => { "imei" => "%{GREEDYDATA:imei_num}" }
	   match => { "__createdAt" => "%{GREEDYDATA:event_data}" }
     }
}
`

Thanks for any help!!

2

Please don't post images of text, that is really hard to read, and some people may not even be able to see it at all.

3

i've added text of the error. I would still appreciate help for fixing this error.

4

Right, well you cannot change the mapping of a field once it is set. So you need to delete the index, put the mapping, then reindex.

5

I deleted the index, and made the same mapping and created a new index. I get the same error as before, i'm not trying to change the mapping of this field at all something else is attempting to change it.