# Mapper for \[clientip\] conflicts with existing mapping in other types:\\n\[mapper \[clientip\] has different \[norms\] values, cannot change from disable to enabled\]

**URL:** <https://discuss.elastic.co/t/mapper-for-clientip-conflicts-with-existing-mapping-in-other-types-n-mapper-clientip-has-different-norms-values-cannot-change-from-disable-to-enabled/131576>\
**Category:** Elasticsearch\
**Created:** [May 12, 2018, 2:48pm UTC](https://discuss.elastic.co/t/mapper-for-clientip-conflicts-with-existing-mapping-in-other-types-n-mapper-clientip-has-different-norms-values-cannot-change-from-disable-to-enabled/131576 "2018-05-12T14:48:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisan/32/12335_2.png) [@chrisan](https://discuss.elastic.co/u/chrisan)\
**Post date:** [May 12, 2018, 2:48pm UTC](https://discuss.elastic.co/t/mapper-for-clientip-conflicts-with-existing-mapping-in-other-types-n-mapper-clientip-has-different-norms-values-cannot-change-from-disable-to-enabled/131576/1 "2018-05-12T14:48:44Z")

</div>

Elasticsearch 6.2.4

We use logstash+elasticsearch to get some bandwidth metrics on our cloudfront usage. This is how logstash parses things: [https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-logstash-api-conf](https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-logstash-api-conf)

This generates indices such as: [https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-indicies](https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-indicies)

With mappings like: [https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-mappings](https://gist.github.com/chrisan/1c5ce5beacfc0e124d39fa842f051857#file-mappings)

I was asked to get distinct IP addresses and I tried using an aggregate query:

```
{
  "size": 0,
    "aggs" : {
        "distinct_ips" : {
            "filter" : { "term": { "company" : "XXX" } },
            "aggs" : {
                "cardinality" : { "cardinality": {"field": "clientip"	} }
            }
        }
    }
}

```

But this returns:

```
{
    "error": {
        "root_cause": [
            {
                "type": "illegal_argument_exception",
                "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [clientip] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
            }
        ],
        "type": "search_phase_execution_exception",
        "reason": "all shards failed",
        "phase": "query",
        "grouped": true,
        "failed_shards": [
            {
                "shard": 0,
                "index": "logstash-2018.01.01",
                "node": "dO1JCnAnSmmk5EfDmfYgqQ",
                "reason": {
                    "type": "illegal_argument_exception",
                    "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [clientip] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
                }
            }
        ]
    },
    "status": 400
}

```

So I tried to update that with

PUT /\*/\_mapping/\_doc?update\_all\_types

```
{
  "properties": {
    "clientip": {
      "type": "text",
      "fielddata": true
    }
  }
}

```

Which returns:

```
{
    "error": {
        "root_cause": [
            {
                "type": "illegal_argument_exception",
                "reason": "Mapper for [clientip] conflicts with existing mapping in other types:\n[mapper [clientip] has different [norms] values, cannot change from disable to enabled]"
            }
        ],
        "type": "illegal_argument_exception",
        "reason": "Mapper for [clientip] conflicts with existing mapping in other types:\n[mapper [clientip] has different [norms] values, cannot change from disable to enabled]"
    },
    "status": 400
}

```

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![chrisan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisan/32/12335_2.png) [@chrisan](https://discuss.elastic.co/u/chrisan)\
**Post date:** [May 17, 2018, 4:37pm UTC](https://discuss.elastic.co/t/mapper-for-clientip-conflicts-with-existing-mapping-in-other-types-n-mapper-clientip-has-different-norms-values-cannot-change-from-disable-to-enabled/131576/2 "2018-05-17T16:37:13Z")

</div>

Figured it out, had to delete everything and then update the logstash template with

```
{
		"template": "logstash",
		"order": 0,
		"version": 60001,
		"index_patterns": [
			"logstash-*"
		],
		"settings": {
			"index": {
				"refresh_interval": "5s"
			}
		},
		"mappings": {
			"_default_": {
				"dynamic_templates": [
					{
						"message_field": {
							"path_match": "message",
							"match_mapping_type": "string",
							"mapping": {
								"type": "text",
								"norms": false
							}
						}
					},
					{
						"string_fields": {
							"match": "*",
							"match_mapping_type": "string",
							"mapping": {
								"type": "text",
								"norms": false,
								"fields": {
									"keyword": {
										"type": "keyword",
										"ignore_above": 256
									}
								}
							}
						}
					}
				],
				"properties": {
					"@timestamp": {
						"type": "date"
					},
					"@version": {
						"type": "keyword"
					},
					"clientip": {
						"type": "text",
						"fields": {
						"keyword": { 
						  "type": "keyword"
						}
					  }
					},
					"company": { 
					  "type": "text",
					  "fields": {
						"keyword": { 
						  "type": "keyword"
						}
					  }
					},
					"geoip": {
						"dynamic": true,
						"properties": {
							"ip": {
								"type": "ip"
							},
							"location": {
								"type": "geo_point"
							},
							"latitude": {
								"type": "half_float"
							},
							"longitude": {
								"type": "half_float"
							}
						}
					}
				}
			}
		},
		"aliases": {}
	}

```

And then I could query with

```
"aggs": {
   "distinct_ips": {
     "cardinality": {
       "field": "clientip.keyword"
     }
   }
 }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2018, 4:37pm UTC](https://discuss.elastic.co/t/mapper-for-clientip-conflicts-with-existing-mapping-in-other-types-n-mapper-clientip-has-different-norms-values-cannot-change-from-disable-to-enabled/131576/3 "2018-06-14T16:37:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.