# Mapper \[kubernetes.labels.app\] of different type, current\_type \[text\], merged\_type \[ObjectMapper\]

**URL:** <https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702>\
**Category:** Elasticsearch\
**Created:** [October 16, 2018, 6:04pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702 "2018-10-16T18:04:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sszabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sszabo/32/36570_2.png) [@sszabo](https://discuss.elastic.co/u/sszabo)\
**Post date:** [October 16, 2018, 6:04pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/1 "2018-10-16T18:04:22Z")

</div>

We get this error in elastic:

java.lang.IllegalArgumentException: mapper [kubernetes.labels.app] of different type, current\_type [text], merged\_type [ObjectMapper]

The message seems to have kubernetes.labels.app set to a string:

```
sszabo@tor976568e1 [/home/sszabo/tmp] $ cat log | jq -r .kubernetes
{
  "namespace": "spinnaker",
  "container": {
    "name": "clouddriver"
  },
  "pod": {
    "name": "spin-clouddriver-59648c5449-snt2x"
  },
  "labels": {
    "app": "spin",
    "cluster": "spin-clouddriver",
    "app.kubernetes.io/managed-by": "halyard",
    "app.kubernetes.io/name": "clouddriver",
    "pod-template-hash": "1520471005",
    "app.kubernetes.io/part-of": "spinnaker",
    "app.kubernetes.io/version": "1.9.5"
  }
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 17, 2018, 7:53am UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/2 "2018-10-17T07:53:40Z")

</div>

Elasticsearch uses dots in fieldnames internally to create an object tree. In the above case `labels.app` and `labels.app.kubernetes` clash, as one is a string and the other creates an inner object. Try `app.name` instead of `app` and this should work.

---

<div class="post-metadata">

**Author:** ![sszabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sszabo/32/36570_2.png) [@sszabo](https://discuss.elastic.co/u/sszabo)\
**Post date:** [October 17, 2018, 3:56pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/3 "2018-10-17T15:56:31Z")

</div>

These labels are set by spinnaker, I have no control over them:

```
sszabo@tor976568e1 [/home/sszabo] $ kubectl get -o yaml pods spin-clouddriver-69768cbb5b-pqthp | yq -y .metadata.labels
app: spin
app.kubernetes.io/managed-by: halyard
app.kubernetes.io/name: clouddriver
app.kubernetes.io/part-of: spinnaker
app.kubernetes.io/version: 1.9.5
cluster: spin-clouddriver
pod-template-hash: '2532476616'
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 17, 2018, 8:46pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/4 "2018-10-17T20:46:17Z")

</div>

you could change the JSON structure before indexing or is that not possible? You havent mentioned a lot about the ingesting infrastructure.

---

<div class="post-metadata">

**Author:** ![sszabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sszabo/32/36570_2.png) [@sszabo](https://discuss.elastic.co/u/sszabo)\
**Post date:** [October 19, 2018, 4:50pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/5 "2018-10-19T16:50:06Z")

</div>

These events are generated by spinnaker pods running under kubernetes. Spinnaker is setting the pod labels which are sent to logstash via filebeat.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 22, 2018, 8:32am UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/6 "2018-10-22T08:32:14Z")

</div>

Then you need to have a mechanism to change this data before indexing.

Either via an Elasticsearch pipeline in an Ingest Node or via ([https://www.elastic.co/guide/en/beats/filebeat/current/rename-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/rename-fields.html))[beats] - you have not mentioned you method of ingestion, that might be helpful in this case.

--Alex

---

<div class="post-metadata">

**Author:** ![sszabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sszabo/32/36570_2.png) [@sszabo](https://discuss.elastic.co/u/sszabo)\
**Post date:** [October 23, 2018, 12:49pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/7 "2018-10-23T12:49:58Z")

</div>

I'll look at using logstash to remove the app label, thanks!

---

<div class="post-metadata">

**Author:** ![sszabo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sszabo/32/36570_2.png) [@sszabo](https://discuss.elastic.co/u/sszabo)\
**Post date:** [October 23, 2018, 3:34pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/8 "2018-10-23T15:34:04Z")

</div>

I was able to rename the label from logstash:

```
filter {

    if [kubernetes] {
            
        if [kubernetes][namespace] == "spinnaker" {
            mutate {
            rename => {"[kubernetes][labels][app]" => "[kubernetes][labels][spinapp]"}
            }
        }

    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 3:37pm UTC](https://discuss.elastic.co/t/mapper-kubernetes-labels-app-of-different-type-current-type-text-merged-type-objectmapper/152702/9 "2018-11-20T15:37:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.